Quantcast
Channel: Active questions tagged blazor - Stack Overflow
Viewing all articles
Browse latest Browse all 4839

Blazor web app OpenID Connect authentication's remote sign-out endpoint gives bad request (400) response because of anti-forgery

$
0
0

In a Blazor SSR web app, I have configured the OIDC authentication and the RemoteSignOutPath has been set.

builder.Services    .AddAuthentication(options =>    {        options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;        options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;    })    .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>    {        // ...    })    .AddOpenIdConnect(options =>    {        options.RemoteSignOutPath = "/oidc-remote-logout";        // ...    });

According to OpenID Connect Back-Channel Logout spec, I need to post a logout token to this endpoint. When I do, I get 400 Bad Request response:

A valid antiforgery token was not provided with the request. Add anantiforgery token, or disable antiforgery validation for thisendpoint.

How can I solve this issue?

Does the framework handle this endpoint and its token validation by itself or do I have to implement it?

This is the middleware orders:

// ...builder.Services.AddRazorComponents();var app = builder.Build();if (app.Environment.IsDevelopment()){    app.UseDeveloperExceptionPage();}else{    app.UseExceptionHandler("/error");}app.MapStaticAssets();app.UseAuthentication();app.UseAuthorization();app.UseAntiforgery();app.MapPost("/logout", async (HttpContext httpContext) =>{    await httpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);    await httpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);});app.MapRazorComponents<App>();

Viewing all articles
Browse latest Browse all 4839

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>