.NET 7 Blazor WASM authentication back button history behavior still problematic with 3rd party IDP

[mikequ-taggysoft]

Summary

.NET 7 improved Blazor WASM's authentication back history behavior in pull #43954. The underlying issue was described in issue #43063 @javiercn

However, after testing the new implementation, I'm still not getting the desirable behavior: back button returns to previous page that does not require authentication.

Motivation and goals

Consider the following typical scenario:

1. User is currently on contoso.com, an unprotected Blazor home page.
2. User clicks a link on the page, contoso.com/protected, which is a protected Blazor page via @attribute [Authorize]
3. The app.razor sees that this is a protected route, and redirects user to contoso.com/Authentication/login via the RedirectToLogin Blazor component.
4. The authentication component in turn redirects the user to a 3rd party IDP login page, such as AAD B2C's contoso.b2clogin.com.
5. Now user realizes this is a protected area, but decides not to sign up or login, and presses the back button, with the intent to go back to the unprotected contoso.com home page.

However, in reality, the back button brings the user to contoso.com/protected, which then redirects the user to /Authentication/login and finally the IDP login page again, still resulting in a loop.

I believe this is a bit better than the previous version, where the back button would bring the user to /Authentication/login which would trigger a failure message.

But I think it would be a much better experience if the new history state manager can store the URL the user was on before the protected page was requested that triggered authentication, and bring the user to that page accordingly when back button is clicked.

[javiercn]

@mikequ-taggysoft thanks for contacting us.

The code to do this is in your app. Essentially inside the RedirectToLogin component, you can replace the navigation entry that goes to /Authentication/login. and that should do what you want.

manager.NavigateTo(loginPath, new NavigationOptions
{
    ReplaceHistoryEntry = true,
    HistoryEntryState = new InteractiveRequestOptions
    {
        Interaction = InteractionType.SignIn,
        ReturnUrl = manager.Uri
    }.ToState()
});

[mikequ-taggysoft]

@javiercn You meant to replace the NavigateToLogin call with the one you wrote with custom options right? However, the ToState() method is internal and cannot be called as is.

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.