Securing Blazor WebAssembly Apps

Learn how to secure Blazor WebAssembly applications with Auth0.
Read more

Brought for you by @andrea.chiarelli

2 Likes

What are you thoughts guys? Share it in the comments! :speech_balloon:

1 Like

Thanks for the article!

What is the best way to add additional custom parameters to the login url?

In Blazor server side you could modify a property in the OnRedirectToIdentityProvider event in options.Events when adding open id connect authentication in startup.cs to add these parameters but I donā€™t see a way to do this in wasmā€¦

1 Like

Hi @afrank,
The current implementation of Microsoft.AspNetCore.Components.WebAssembly.Authentication doesnā€™t support passing additional parameters, as documented by this issue.
This is the reason why you need to use a default audience to work around passing the audience parameter.

2 Likes

Thanks for the answer @andrea.chiarelli!

Hopefully they will add this in the future.

1 Like

Hi @andrea.chiarelli the post was great. Can you write one to access de profile and claims? When there will be a SDK for blazor in Auth0?

1 Like

First thank you for the article. A couple questions:
The issue you mentioned about Blazorā€™s inability to provide additional query arguments at login would seem to suggest it is not possible to specify a particular Auth0 connection at login. Is there some way you can see to work around this and log in with a specified connection?
When I log out the application appears to have logged me out but if I select the login link again Iā€™m immediately authenticated again without actually going through the login process. Something appears to be preserved in the application state that is not being cleared by logout. Any thoughts?

1 Like

Iā€™m sure Andrea will try to address that once heā€™s online. Thanks for all the input!

Hey @dane.vinson,
The Authentication.razor component implements logout by disconnecting the client from Auth0.
However, as highlighted in a note in the article, it seems that in some circumstances the HTTP request to the logout endpoint doesnā€™t happen.
I think it is a Blazor issue because this behavior is random on my side.

1 Like

Hi @lprada, thanks for appreciating it :slight_smile:
I will take into account your suggestion for a future blog post.
Regarding an Auth0 SDK for Blazor, as far as I know, currently there is no plan for this.

1 Like

In working through this article Iā€™ve found that when I assign the RemoteAuthenticationOptions.ProviderOptions.ResponseType to ā€œcodeā€ I get a 401 response with the message ā€œThere was an error trying to log you in: ā€˜ā€™ā€. If I do not assign the ResponseType (defaults to token?) the login succeeds, however, after successful login attempts access my API fail at the TryGetToken method. Inspection of the AccessTokenResult shows itā€™s Status is RequiredRedirect. Any thoughts on what I can try here?

1 Like

Hey there @dane.vinson!

Iā€™m sure Andrea will address that once heā€™s back from vacation.

1 Like

Hey @dane.vinson, that behavior looks quite weird. Are you getting the same error even running the complete project attached to the article?

When I created the Auth0 app I created it as a Regular Web Application instead of a Single Page Application. I updated that and got past the previous issues (though at this point Iā€™m still getting a 401 when I call a method on the Web API).

1 Like

Iā€™ve downloaded the completed project, updated the ā€œAuthorityā€ and ā€œApiIdentifierā€ appsettings in the API project with my Auth0 authority and API identifier then updated the ā€œAuthorityā€ and ā€œClientIdā€ appsettings in the client project with my Auth0 authority and my applicationā€™s ClientId. I can log in with the client but I get 401 when trying to access the quiz endpoint. Also, after the 401 error in the browser I get a second, content type is not supported error, i.e. ā€œThe provided ContentType is not supported; the supported types are ā€˜application/jsonā€™ and the structured syntax suffix ā€˜application/+jsonā€™ā€.

1 Like

I discovered that the Default Audience that Iā€™d provided in my Domain Settings did not actually save. I was finally able to get it to save after three consecutive times entering and saving and now both your POC and mine are working.

1 Like

Thanks for providing all that context @dane.vinson!

Hey @dane.vinson, happy to hear you found the reason of the issue.

Thanks for the guide! I have tried following it as closely as possible and after double checking Iā€™m not quite sure why my implementation is failing logins, similarly to dane.vinson. After logging in through the universal login, I get redirected back to my app but am met with no change to the access control component and a message saying ā€œThere was an error logging you inā€. In the debug log I see two 401 errors, but Iā€™m not sure why. If anyone has any clues I would appreciate the assistance!

1 Like

Hi @gonsalvg, welcome to Auth0 Community! :wave:

Have you checked that your default audience is correctly saved on the Auth0 dashboard? That was the issue for dane.vinson.

Otherwise, please check more info in the logs in the Auth0 dashboard and/or share with us a detailed track of the HTTP request and response originating the issue.
We will try to understand what is going on.