WebApplication.UseStatusCodePages() cannot handle unauthorized requests without explicit UseAuthorization() call

[marinasundstrom]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

These are observations from implementing auth with Server-side rendered pages (SSR) in Blazor Preview 6 - using Razor components instead of MVC Razor pages.

Cookie auth just works, that is great. But there are some issues:

Issues:

• AuthorizeRouteView doesn't work with the router. The NotAuthorized fragment does not get rendered. Instead I get redirected to a layout-less page saying: Error: 401 Unauthorized.

• The LoginDisplay doesn't re-ender when logged in using form. Redirecting to another page would help here.

Questions:

• How do I redirect to another URL from a component that server render? NavigationManager of course doesn't work here.

My github repo (branch): https://github.com/marinasundstrom/Blazor8Test/tree/auth

Expected Behavior

When unauthorized and entering page that requires authorization,
I expect the NotAuthorized fragment to be rendered with the MainLayout.

Steps To Reproduce

https://github.com/marinasundstrom/Blazor8Test/tree/auth

Exceptions (if any)

No response

.NET Version

8.0.100-preview.6.23330.14

Anything else?

No response

[javiercn]

How do I redirect to another URL from a component that server render? NavigationManager of course doesn't work here.

Navigation manager should work (not sure if it does in Preview6). There might be some conflicts with the SSR navigation manager overriding the static renderer one.

[marinasundstrom]

@javiercn OK. Yes. I'm on Preview 6 and it uses the RemoteNavigationManager even for server-side rendered page. And when invoking NavigateTo on the server, an exception is thrown.

My workaround was to build my own "ServerNavigationManager" (Not inheriting from NavigationManager) which modifies the HttpContext.Response to redirect to the specified location.

[javiercn]

@marinasundstrom where are you seeing the 401 from the authorizeview?

On SSR, the auth middleware should be handling the auth for the page.

[marinasundstrom]

@javiercn Here: https://blazor8app.graypebble-0c46426e.westus2.azurecontainerapps.io/auth

"/auth" is a page.

Unless I have missed something in my code.

https://github.com/marinasundstrom/Blazor8Test

[marinasundstrom]

I have learned that the component model doesn't handle the cases the same way with SSR as with Client. That makes sense, since it is about requests.

But the symptoms are still here in RC1, somewhere between component and middleware.

Not even app.UseStatusCodePagesWithRedirects("/error/{0}"); catches it as with other errors.

Still just a page with the text: Error: 401

Component file: https://github.com/marinasundstrom/Blazor8Test/blob/auth/src/Server/Pages/Auth.razor

[ghost]

To learn more about what this message means, what to expect next, and how this issue will be handled you can read our Triage Process document.
We're moving this issue to the .NET 9 Planning milestone for future evaluation / consideration. Because it's not immediately obvious what is causing this behavior, we would like to keep this around to collect more feedback, which can later help us determine how to handle this. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact work.

[halter73]

WebApplication's automatic UseAuthorization() insertion happens before the user-configured UseStatusCodePagesWithRedirecte(). By adding UseAuthorization() explicitly, we can ensure UseStatusCodePagesWithRedirecte() "sees" unauthorized requests.

https://learn.microsoft.com/en-us/aspnet/core/fundamentals/minimal-apis/middleware?view=aspnetcore-8.0

I submitted a PR to your github repo to fix the issue. marinasundstrom/Blazor8Test#3

I don't think this is a Blazor specific issue, but I do wonder if WebApplication could be a little smarter and insert UserAuthorization after UseStatusCodePages if it's being used, because this seems really easy to mess up. I don't want to make the automatic middleware initialization much more complicated than it already is though.