CORS issue in a hosted Blazor solution

Question

question

anastasia-3024 asked Apr 26, '22 anastasia-3024 commented Apr 28, '22

CORS issue in a hosted Blazor solution

I have a hosted Blazor app based on Blazor webAssembly project template. I use azure AD B2C standard user flow for user authentication. I can log in when I run the app on the localhost, but I can not access endpoints from a controller that requires user to be authenticated. The issue seems to be CORS related and happens while sending request to https://xxx.b2clogin.com/xxx.onmicrosoft.com/b2c_1_signin/oauth2/v2.0/authorize:

I use a custom AuthorizationMessageHandler class, as reccomended here and register it in the client's services like that:

 builder.Services.AddScoped<CustomAuthorizationMessageHandler>();
 builder.Services.AddHttpClient("xxxAPI",
         client => client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))
     .AddHttpMessageHandler<CustomAuthorizationMessageHandler>();

CustomAuthorizationMessageHandler:

 public class CustomAuthorizationMessageHandler : AuthorizationMessageHandler
     {
         public CustomAuthorizationMessageHandler(IAccessTokenProvider provider,
             NavigationManager navigationManager)
             : base(provider, navigationManager)
         {
             ConfigureHandler(
                 authorizedUrls: new[] {"https://xxx.b2clogin.com/"},
                 scopes: new[] {"user.read", "user.write"});
         }
     }

Am I missing something else?

azure-ad-b2c dotnet-aspnet-core-blazor

image.png (25.9 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ZhiLv-MSFT · Apr 27 at 07:46 AM

Can you tell us the detailed version about the Asp.net core version and the Visual Studio (2019 or 2022) version?

Besides, can you share the CORS configuration? you could refer to this part:#Cross-origin resource sharing (CORS).

0 ·

Answer 1 · 2022-04-26T15:41:46.76Z

Bruce-SqlWork answered Apr 26, '22 anastasia-3024 commented Apr 28, '22

the api you are calling appears to be redirecting to the azure ad oauth login server (probably using web flow). the ad login server does not support Ajax logins.

typically the blazer app would use msal client library to login in, then use the returned token to call the webapi. the webapi should just return a 401 for missing/invalid jwt token, not a redirect.

https://docs.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/standalone-with-azure-active-directory?view=aspnetcore-6.0

note: if you want to use web flow and cookies, then the index.html page should require authentication. you should change the webapi to return 401 error rather than redirect. on the client side if you get a 401 error (expired token), set location to index.html, which force a reload and authentication.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

anastasia-3024 · Apr 27 at 09:14 AM

I found out it was wrong service configuration in Server app. Thank you for answers, the ticket can be closed

0 ·

question