DI for authentication service in standalone Server.Web project?

[MarTechView]

Hello, first off, this is an amazing project. I've been working on learning Blazor and this project has been an incredible resource in helping me on my journey. Thank you for sharing it!

Next, where is Authentication service setup for Server.Web in the boilerplate solution when the API is setup to run standalone, versus integrated?

In the Program.Middleware.cs in the Server.Web project, it has "app.UseAuthentication();" but I don't see where "AddAuthentication" or the equivalent is added via one of the projects.

I don't know if it is just me but I get the following when trying to run the Server.Web project:

Message=Unable to resolve service for type 'Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider' while attempting to activate 'Microsoft.AspNetCore.Authentication.AuthenticationMiddleware'.

Should "app.UseCors();" also be present in the Program.Middleware.cs in the Server.Web project with standalone API?

[ysmoradi]

Hi there,

Here are the most common setup options:

1. Standalone Server.Api + Client.Web (with or without Blazor hybrid mobile & desktop apps).
2. Integrated Server.Web.

If you don’t need pre-rendering, you can simply publish Client.Web on Azure Static Pages (like https://todo-small.bitplatform.cc/).

However, if you do need pre-rendering, deploying the integrated Server.Web setup offers better performance. This is because you can set the ServerAddress to http://localhost:8080 via server environment variables, which overrides the default ServerAddress defined in Client.Core/appsettings.json during pre-rendering. This allows Razor pages to fetch RESTful HTTP client-based data much faster.

Due to these considerations, using a standalone Server.Web setup is uncommon and has not been extensively tested.

I’m currently preparing a PR to address this issue and will include more details in the PR description.

---

[ysmoradi]

With bitplatform, due the quick issue resolving lifecycle that we have, it doesn't really matter what path you choose, we've got you covered (":
And I'd recommend PWA + Pre-rendering + Blazor WASM for as a replacement for your second item. It would work just like https://todo.bitplatform.dev

[MarTechView]

Will do, thank you for the recommendation!

Honestly, the architecture of this platform is fantastic! Getting to know it takes some time but it is so well thought out in its hierarchy and organization.

[MarTechView]

#9572 #9573

A couple of thoughts on the changes (maybe issues?):

options.BearerTokenProtector = new SimpleJWTFormat(); options.RefreshTokenProtector = new SimpleJWTFormat();

Assuming that should be SimpleJwtSecureDataFormat?

Also, it looks like a call was added to the Server.Web program.Services.cs for this:

services.AddAuthorization();

Technically, I believe Authorization is also wired up via the Shared project, which trickles its way up to Core, Client.Web, and then the Server.Web projects, ISharedServiceCollectionExtensions.cs, AddSharedProjectServices():

services.ConfigureAuthorizationCore();

public static void ConfigureAuthorizationCore(this IServiceCollection services) { services.AddAuthorizationCore(options => { options.AddPolicy(AuthPolicies.TFA_ENABLED, x => x.RequireClaim("amr", "mfa")); options.AddPolicy(AuthPolicies.PRIVILEGED_ACCESS, x => x.RequireClaim(AppClaimTypes.PRIVILEGED_SESSION, "true")); options.AddPolicy(AuthPolicies.ELEVATED_ACCESS, x => x.RequireClaim(AppClaimTypes.ELEVATED_SESSION, "true")); }); }

You know better than I if the dual calls is a problem, but just wanted to point it out.

[ysmoradi]

The Shared project is adding AuthorizationCore, but in Server.Web we're adding Authorization, I'm not sure if the Shared one is enough for the Server and I see no harm in calling it.

[ysmoradi]

options.BearerTokenProtector = new SimpleJWTFormat(); options.RefreshTokenProtector = new SimpleJWTFormat();

Assuming that should be SimpleJwtSecureDataFormat?

I Fixed that in another PR (":

[msynk]

@MarTechView Thanks for contacting us.
I just wanted to let you know that we appreciate your keen investigations into our products and welcome any suggestions that can improve them or help others. we will try our best to resolve all requests as much as possible.
Thanks in advance 🚀