Blazor Authorization - AuthorizeRouteView and RedirectToLogin not working.

[christallire]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I've created Blazor WebApp via VS 2022 template with individual identity.
No matter what I do, <AuthorizeRouteView> and <NotAuthorized> are not working and redirect any request to /Account/Login. putting <p>not working</p> doesn't help.

Expected Behavior

<Router AppAssembly="@typeof(Program).Assembly">
    <Found Context="routeData">
        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(Layout.MainLayout)">
            <NotAuthorized>
                <p>not authorized</p>
            </NotAuthorized>
        </AuthorizeRouteView>
        <FocusOnNavigate RouteData="@routeData" Selector="h1" />
    </Found>
</Router>

Prints "not authorized" when you click "Auth Required" in the template app

Steps To Reproduce

1. Create Blazor Web App with Server Interactive render mode, and with Individual Account Authentication type.
2. Replace from "<RedirectToLogin />" to "<p>not authorized</p>" in Routes.razor (to see if your redirection is from RedirectToLogin component)
3. Click "Auth Required" in template app.

Exceptions (if any)

No response

.NET Version

8.0.100

Anything else?

This is a blocker since I was migrating .NET 7.0 app to .NET 8.0, but It behaves very differently.

[appsolab]

Same here. Since RC1 I can't migrate without this issue.

[MackinnonBuck]

@halter73 Would you be able to look into this?

[christallire]

Another thing I noticed Is that an authorization check (the route with [Authorize] Attribute) is done before the component lifecycle or Routing.
For an example. I used to put OnInitialized and handle some logic in what we now call Routes.razor. When I refresh the page, no routing or component lifecycle logic runs. Is this where we have the bug?

.NET 7.0
No auth - Route OnInitialized = YES
Req Auth- Route OnInitialized = YES

.NET 8.0
No auth - Route Oninitialized = YES
Req Auth - Route OnInitialized = NO

Upon investigating all other interactivity - the same thing happens when refresh. It looks like there's something with pipeline.

[christallire]

it seems the new 8.0 routing adds pages with [Authorization] to route, so that they have authorization metadata and can be checked with AuthorizationMiddleware if we prerender or first render (when we have HttpContext)

The request runs through pipelines, Invoking Authentication middleware first, and if this fails (no login, so always) - doing redirection defined in middleware.
But this is different, especially when we navigate with SPA and there's no Authentication middleware (obviously), and AuthenticationStateProvider is invoked instead of the middleware.

I think someone really messed this up.

edit: When I add JwtBearer authentication to the application they just throw 401 so authorization middleware it is.

[christallire]

@MackinnonBuck can we urgently have a look into this? this seems serious because Authorization in blazor is basically broken.

[joecuevasjr]

I'm experiencing the same issue as @christallire. This was working as expected in NET 7. In my case I'm using a Cookie for auth but I don't utilize the Cookie's options.LoginPath configuration. I prefer to use the <NotAuthorized> template directive.

[augustevn]

@halter73 @MackinnonBuck @mkArtakMSFT

I did some digging, it seems like the user Claims are no longer returned from /manage/info from the .MapIdentityApi<User>().

This change broke my app, worked in RC2 not in RTM. Is this intentional? Possibly related.

IdentityApiEndpointRouteBuilderExtensions.cs, line 455:

    private static async Task<InfoResponse> CreateInfoResponseAsync<TUser>(TUser user, UserManager<TUser> userManager)
        where TUser : class
    {
        return new()
        {
            Email = await userManager.GetEmailAsync(user) ?? throw new NotSupportedException("Users must have an email."),
            IsEmailConfirmed = await userManager.IsEmailConfirmedAsync(user),
        };
    }

[augustevn]

@christallire How do you implement the AuthenticationStateProvider and do you pass your claims to it? If so, could you check whether your claims are empty or not?