Skip to content

Use SignalR authentication refresh for Blazor Identity #68663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
javiercn wants to merge 5 commits into from
Open

Use SignalR authentication refresh for Blazor Identity #68663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
de7b784
Use SignalR authentication refresh for Blazor Identity
javiercn Aug 20, 2026
e4b0573
Enforce Blazor authentication refresh expiration
javiercn Aug 21, 2026
5a58ce3
Configure server-enforced Blazor auth refresh
javiercn Aug 21, 2026
5a6ad6b
Align refresh with Identity stamp validation
javiercn Aug 21, 2026
5aaa56b
Remove redundant SignalR expiration tests
javiercn Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions src/Components/test/E2ETest/ServerExecutionTests/ServerAuthTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,29 @@ object RefreshAuthentication() =>
""");
}

[Fact]
public void UpdatesAuthenticationStateWhenAuthenticationRefreshesAutomatically()
{
SignInAs("user-a", "TestRole", includeNameIdentifier: true);
var appElement = MountAndNavigateToAuthTest(
AuthorizeViewCases,
"?captureAuthenticationRefresh&accelerateAuthenticationRefresh");
Browser.Equal("Welcome, user-a!", () =>
appElement.FindElement(By.CssSelector("#authorize-role .authorized")).Text);

var javascript = (IJavaScriptExecutor)Browser;
var connectionId = Assert.IsType<string>(
javascript.ExecuteScript("return authenticationRefreshConnection.connectionId;"));

SignInAs(null, null, useSeparateTab: true);

Browser.Equal("You're not authorized, anonymous", () =>
appElement.FindElement(By.CssSelector("#authorize-role .not-authorized")).Text);
Assert.Equal(
connectionId,
Assert.IsType<string>(javascript.ExecuteScript("return authenticationRefreshConnection.connectionId;")));
}

private void SignInAs(
string userName,
string roles,
Expand Down
6 changes: 5 additions & 1 deletion src/Components/test/testassets/Components.TestServer/AuthenticationStartup.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,11 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
endpoints.MapControllers();
endpoints.MapRazorPages();
endpoints.MapBlazorHub()
endpoints.MapBlazorHub(options =>
{
options.MaximumAuthenticationExpiration = TimeSpan.FromMinutes(40);
options.CloseOnAuthenticationExpiration = true;
})
.AddEndpointFilter(async (context, next) =>
{
if (context.HttpContext.WebSockets.IsWebSocketRequest)
Expand Down
12 changes: 11 additions & 1 deletion src/Components/test/testassets/Components.TestServer/Pages/_ServerHost.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,9 +53,19 @@

<script src="_framework/blazor.server.js" autostart="false"></script>
<script>
const query = new URLSearchParams(location.search);
if (query.has('accelerateAuthenticationRefresh')) {
const setTimeout = window.setTimeout;
window.setTimeout = (handler, timeout, ...args) =>
setTimeout(
handler,
timeout >= 34 * 60 * 1000 && timeout <= 35 * 60 * 1000 ? 1000 : timeout,
...args);
}

Blazor.start({
configureSignalR: builder => {
if (new URLSearchParams(location.search).has('captureAuthenticationRefresh')) {
if (query.has('captureAuthenticationRefresh')) {
const build = builder.build.bind(builder);
builder.build = () => {
const connection = build();
Expand Down
6 changes: 0 additions & 6 deletions ...ectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/.template.config/template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,12 +152,6 @@
"BlazorWebCSharp.1/Components/Pages/Auth.razor"
]
},
{
"condition": "(!(IndividualLocalAuth && UseServer))",
"exclude": [
"BlazorWebCSharp.1/Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs"
]
},
{
"condition": "(IndividualLocalAuth && UseLocalDB && UseWebAssembly)",
"rename": {
Expand Down
23 changes: 23 additions & 0 deletions .../BlazorWebCSharp.1/Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Components.Authorization;
using Microsoft.AspNetCore.Components.Server;
using Microsoft.AspNetCore.Http.Extensions;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
Expand All @@ -15,6 +16,28 @@ namespace Microsoft.AspNetCore.Routing;

internal static class IdentityComponentsEndpointRouteBuilderExtensions
{
// SignalR refreshes five minutes before this expiration, after Identity's default 30-minute
// security stamp validation interval has elapsed. Update this value if that interval is customized.
private static readonly TimeSpan s_maximumAuthenticationExpiration = TimeSpan.FromMinutes(40);

public static void ConfigureIdentityAuthenticationRefresh(this ServerComponentsEndpointOptions options)

@halter73 halter73 Aug 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This only composes if ConfigureConnection was assigned before the call. Assigning it after, which is the natural edit to make in that lambda in Program.cs, silently drops the cap and CloseOnAuthenticationExpiration and auth just quietly goes stale. Is composing worth much if it only covers one of the two orders?

I think we probably shouldn't bother even trying to run any existing options.ConfigureConnection callback. It's templated code, so people are free to modify ConfigureIdentityAuthenticationRefresh themselves if they want to merge their logic with the clamping logic.

{
ArgumentNullException.ThrowIfNull(options);

var configureConnection = options.ConfigureConnection;
options.ConfigureConnection = connectionOptions =>
{
configureConnection?.Invoke(connectionOptions);

if (connectionOptions.MaximumAuthenticationExpiration is not { } maximumExpiration ||
maximumExpiration > s_maximumAuthenticationExpiration)
{
connectionOptions.MaximumAuthenticationExpiration = s_maximumAuthenticationExpiration;
}
connectionOptions.CloseOnAuthenticationExpiration = true;
};
}

// These endpoints are required by the Identity Razor components defined in the /Components/Account/Pages directory of this project.
public static IEndpointConventionBuilder MapAdditionalIdentityEndpoints(this IEndpointRouteBuilder endpoints)
{
Expand Down
47 changes: 0 additions & 47 deletions ...p/BlazorWebCSharp.1/Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs
View file
Open in desktop

This file was deleted.

14 changes: 8 additions & 6 deletions ...Templates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Program.Main.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,4 @@
#if (IndividualLocalAuth)
#if (UseServer)
using Microsoft.AspNetCore.Components.Authorization;
#endif
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
#endif
Expand Down Expand Up @@ -47,9 +44,6 @@ public static void Main(string[] args)
#if (IndividualLocalAuth)
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddScoped<IdentityRedirectManager>();
#if (UseServer)
builder.Services.AddScoped<AuthenticationStateProvider, IdentityRevalidatingAuthenticationStateProvider>();
#endif

builder.Services.AddAuthentication(options =>
{
Expand Down Expand Up @@ -110,11 +104,19 @@ public static void Main(string[] args)
app.MapStaticAssets();
#if (UseServer && UseWebAssembly)
app.MapRazorComponents<App>()
#if (IndividualLocalAuth)
.AddInteractiveServerRenderMode(options => options.ConfigureIdentityAuthenticationRefresh())
#else
.AddInteractiveServerRenderMode()
#endif
.AddInteractiveWebAssemblyRenderMode()
#elif (UseServer)
app.MapRazorComponents<App>()
#if (IndividualLocalAuth)
.AddInteractiveServerRenderMode(options => options.ConfigureIdentityAuthenticationRefresh());
#else
.AddInteractiveServerRenderMode();
#endif
#elif (UseWebAssembly)
app.MapRazorComponents<App>()
.AddInteractiveWebAssemblyRenderMode()
Expand Down
14 changes: 8 additions & 6 deletions ...ojectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,4 @@
#if (IndividualLocalAuth)
#if (UseServer)
using Microsoft.AspNetCore.Components.Authorization;
#endif
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
#endif
Expand Down Expand Up @@ -41,9 +38,6 @@
#if (IndividualLocalAuth)
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddScoped<IdentityRedirectManager>();
#if (UseServer)
builder.Services.AddScoped<AuthenticationStateProvider, IdentityRevalidatingAuthenticationStateProvider>();
#endif

builder.Services.AddAuthentication(options =>
{
Expand Down Expand Up @@ -103,11 +97,19 @@
app.MapStaticAssets();
#if (UseServer && UseWebAssembly)
app.MapRazorComponents<App>()
#if (IndividualLocalAuth)
.AddInteractiveServerRenderMode(options => options.ConfigureIdentityAuthenticationRefresh())
#else
.AddInteractiveServerRenderMode()
#endif
.AddInteractiveWebAssemblyRenderMode()
#elif (UseServer)
app.MapRazorComponents<App>()
#if (IndividualLocalAuth)
.AddInteractiveServerRenderMode(options => options.ConfigureIdentityAuthenticationRefresh());
#else
.AddInteractiveServerRenderMode();
#endif
#elif (UseWebAssembly)
app.MapRazorComponents<App>()
.AddInteractiveWebAssemblyRenderMode()
Expand Down
6 changes: 0 additions & 6 deletions src/ProjectTemplates/test/Templates.Tests/template-baselines.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -799,7 +799,6 @@
"Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs",
"Components/Account/IdentityNoOpEmailSender.cs",
"Components/Account/IdentityRedirectManager.cs",
"Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs",
"Components/Account/Pages/AccessDenied.razor",
"Components/Account/Pages/ConfirmEmail.razor",
"Components/Account/Pages/ConfirmEmailChange.razor",
Expand Down Expand Up @@ -928,7 +927,6 @@
"Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs",
"Components/Account/IdentityNoOpEmailSender.cs",
"Components/Account/IdentityRedirectManager.cs",
"Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs",
"Components/Account/Pages/AccessDenied.razor",
"Components/Account/Pages/ConfirmEmail.razor",
"Components/Account/Pages/ConfirmEmailChange.razor",
Expand Down Expand Up @@ -1353,7 +1351,6 @@
"{ProjectName}/Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs",
"{ProjectName}/Components/Account/IdentityNoOpEmailSender.cs",
"{ProjectName}/Components/Account/IdentityRedirectManager.cs",
"{ProjectName}/Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs",
"{ProjectName}/Components/Account/Pages/AccessDenied.razor",
"{ProjectName}/Components/Account/Pages/ConfirmEmail.razor",
"{ProjectName}/Components/Account/Pages/ConfirmEmailChange.razor",
Expand Down Expand Up @@ -1813,7 +1810,6 @@
"{ProjectName}/Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs",
"{ProjectName}/Components/Account/IdentityNoOpEmailSender.cs",
"{ProjectName}/Components/Account/IdentityRedirectManager.cs",
"{ProjectName}/Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs",
"{ProjectName}/Components/Account/Pages/AccessDenied.razor",
"{ProjectName}/Components/Account/Pages/ConfirmEmail.razor",
"{ProjectName}/Components/Account/Pages/ConfirmEmailChange.razor",
Expand Down Expand Up @@ -1890,7 +1886,6 @@
"Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs",
"Components/Account/IdentityNoOpEmailSender.cs",
"Components/Account/IdentityRedirectManager.cs",
"Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs",
"Components/Account/Pages/AccessDenied.razor",
"Components/Account/Pages/ConfirmEmail.razor",
"Components/Account/Pages/ConfirmEmailChange.razor",
Expand Down Expand Up @@ -2172,7 +2167,6 @@
"{ProjectName}/Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs",
"{ProjectName}/Components/Account/IdentityNoOpEmailSender.cs",
"{ProjectName}/Components/Account/IdentityRedirectManager.cs",
"{ProjectName}/Components/Account/IdentityRevalidatingAuthenticationStateProvider.cs",
"{ProjectName}/Components/Account/Pages/AccessDenied.razor",
"{ProjectName}/Components/Account/Pages/ConfirmEmail.razor",
"{ProjectName}/Components/Account/Pages/ConfirmEmailChange.razor",
Expand Down
Loading