Skip to content

Handle direct navigation to the authentication login callback - #69721

Open
vendasankarsf3945 wants to merge 6 commits into
dotnet:mainfrom
vendasankarsf3945:fix/54586-login-callback-navigation
Open

vendasankarsf3945 wants to merge 6 commits into
dotnet:mainfrom
vendasankarsf3945:fix/54586-login-callback-navigation

Conversation

@vendasankarsf3945

Copy link
Copy Markdown
Contributor

Handle explicit login-callback navigation in Blazor WASM

Description

Explicit navigation to /authentication/login-callback in Blazor WebAssembly can leave the app stuck in the CompletingLoggingIn segment of RemoteAuthenticatorView, even though no login flow is active. This makes the app appear broken when users land directly on the callback route.

Root cause

Users could explicitly navigate to the /authentication/login-callback route in a Blazor WebAssembly app. In those cases, the app treated the navigation like a normal authentication callback and left the user in the CompletingLoggingIn segment of RemoteAuthenticatorView, even though no login flow was actively in progress. This caused the app to appear stuck and the user experience to degrade.

Changes

  • Detect explicit browser navigation to /authentication/login-callback
  • Differentiate between a real programmatic authentication callback and a direct user navigation
  • Redirect users back into the login flow instead of leaving them stranded in the callback state
  • Preserve the normal login-completion flow for legitimate authentication callbacks

Before

A user directly navigates to /authentication/login-callback:

  • the app remains in the CompletingLoggingIn segment
  • no redirect is triggered
  • the UI appears to hang or stop working
  • the user is left without a clear recovery path

After

A user directly navigates to /authentication/login-callback:

  • the app recognizes it as an explicit navigation
  • the user is redirected back into the login flow
  • the authentication state completes correctly
  • the user is no longer stuck in a non-working callback state

Fixes #54586

@github-actions github-actions Bot added the area-blazor Includes: Blazor, Razor Components label Oct 8, 2026
@dotnet-policy-service dotnet-policy-service Bot added the community-contribution Indicates that the PR has been added by a community member label Oct 8, 2026
@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Thanks for your PR, @vendasankarsf3945. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

@dotnet-policy-service
dotnet-policy-service Bot deployed to copilot-pat-pool October 8, 2026 09:51 Active
@dotnet-policy-service
dotnet-policy-service Bot deployed to copilot-pat-pool October 8, 2026 09:51 Active
…into fix/54586-login-callback-navigation

# Conflicts:
#	src/Components/test/testassets/Components.TestServer/Components.TestServer.csproj
@vendasankarsf3945
vendasankarsf3945 marked this pull request as ready for review October 19, 2026 09:19
@vendasankarsf3945
vendasankarsf3945 requested a review from a team as a code owner October 19, 2026 09:19
Copilot AI balanced review requested due to automatic review settings October 19, 2026 09:19

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Unresolved build dependencies, custom-provider compatibility, and test isolation issues block approval.

4 open issues
What changed in this PR

This PR addresses #54586 by restarting login when users navigate directly to a Blazor WebAssembly authentication callback, while preserving iframe callback behavior.

Changes:

  • Adds top-level window checks to both authentication providers.
  • Updates callback handling and unit tests.
  • Adds browser coverage and an MSAL test application.
File Description
src/​Components/​WebAssembly/​WebAssembly.Authentication/​test/​RemoteAuthenticatorCoreTests.cs Tests top-level and iframe callbacks.
src/​Components/​WebAssembly/​WebAssembly.Authentication/​src/​RemoteAuthenticatorViewCore.cs Restarts login for top-level callbacks.
src/​Components/​WebAssembly/​WebAssembly.Authentication/​src/​Interop/​AuthenticationService.ts Adds OIDC window-context check.
src/​Components/​WebAssembly/​Authentication.Msal/​src/​Interop/​AuthenticationService.ts Adds MSAL window-context check.
src/​Components/​test/​testassets/​Components.WasmRemoteAuthentication/​Pages/​TestRemoteAuthentication.razor Adds root landing route.
src/​Components/​test/​testassets/​Components.WasmRemoteAuthentication/​Pages/​SilentAuthentication.razor Adds silent-authentication observation page.
src/​Components/​test/​testassets/​Components.WasmMsalRemoteAuthentication/​Routes.razor Configures MSAL test routing.
src/​Components/​test/​testassets/​Components.WasmMsalRemoteAuthentication/​RedirectToLogin.razor Initiates MSAL login.
src/​Components/​test/​testassets/​Components.WasmMsalRemoteAuthentication/​Program.cs Configures MSAL authentication paths.
src/​Components/​test/​testassets/​Components.WasmMsalRemoteAuthentication/​Pages/​TestRemoteAuthentication.razor Displays authentication outcome.
src/​Components/​test/​testassets/​Components.WasmMsalRemoteAuthentication/​Pages/​Authentication.razor Hosts authentication actions.
src/​Components/​test/​testassets/​Components.WasmMsalRemoteAuthentication/​Components.WasmMsalRemoteAuthentication.csproj Defines MSAL test application.
src/​Components/​test/​testassets/​Components.TestServer/​RemoteMsalAuthenticationStartup.cs Hosts MSAL test endpoints.
src/​Components/​test/​testassets/​Components.TestServer/​RemoteAuthenticationStartup.cs Adds callback controls and observations.
src/​Components/​test/​testassets/​Components.TestServer/​RazorComponents/​RemoteMsalAuthenticationApp.razor Hosts and instruments MSAL app.
src/​Components/​test/​testassets/​Components.TestServer/​RazorComponents/​RemoteAuthenticationApp.razor Observes iframe callback handling.
src/​Components/​test/​testassets/​Components.TestServer/​Components.TestServer.csproj References MSAL test dependencies.
src/​Components/​test/​E2ETest/​Tests/​RemoteMsalAuthenticationTest.cs Tests direct MSAL callback navigation.
src/​Components/​test/​E2ETest/​Tests/​RemoteAuthenticationTest.cs Tests direct navigation and iframe behavior.

Review effort: Balanced

Comment thread src/Components/test/E2ETest/Tests/RemoteAuthenticationTest.cs
@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime.
To make sure no conflicting changes have occurred, please rerun validation before merging. You can do this by leaving an /azp run comment here (requires commit rights), or by simply closing and reopening.

@dotnet-policy-service dotnet-policy-service Bot added the pending-ci-rerun When assigned to a PR indicates that the CI checks should be rerun label Oct 26, 2026

This branch was successfully deployed

1 active (outdated) deployment
copilot-pat-pool — 1582437b Deployed Oct 8, 2026 by dotnet-policy-service[bot] via pat_pool #1766
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-blazor Includes: Blazor, Razor Components community-contribution Indicates that the PR has been added by a community member pending-ci-rerun When assigned to a PR indicates that the CI checks should be rerun

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Blazor WASM: Catch explicit navigation to authentication/login-callback and redirect to login

3 participants