BlazorWebAssemblyStandaloneWithIdentity uses cookie auth but no antiforgerytoken

[nathan-parkinson]

Description

The BlazorWebAssemblyStandaloneWithIdentity sample uses a cookie to store the authentication token but I believe that this opens the site up to csrf attacks.

This is usually mitigated by using antiforgerytokens but I've found it difficult to apply this to the sample as the api and client run as different sites (although I may have just dome something wrong).

Is is right that antiforgery tokens should be used here or is there a reason it is not required?
If it is required will it be added to this sample or can someone point me in the right direction to get this working?

Page URL

https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/standalone-with-identity?view=aspnetcore-8.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/blazor/security/webassembly/standalone-with-identity.md

Document ID

c4e6ec41-7bea-e600-6473-c5c870aab082

Article author

@guardrex

[github-actions]

🍂🎁 Happy Holidays! ❄️⛄

A green dinosaur 🦖 will be along shortly to assist. Stand-by ........

[guardrex]

Thanks for opening the issue this way. We use the metadata to track work on these.

It should be automatic and transparent. If you look at a request in browser tools, you should see the antiforgery cookie named something like .AspNetCore.Antiforgery.XXXXXXX on each request.

I agree that it would be nice if the article addressed this subject to head off concerns about it.

@JeremyLikness ... Plz confirm for us that devs don't need to sweat XSRF with basic use of this solution, and are there any gotchas 😈 that are worth calling out?

[nathan-parkinson]

I have run the Backend and BlazorWasmAuth projects, registered and logged in without the Antiforgery cookie being created.

There is no cookie in the dev tools called .AspNetCore.Antiforgery.XXXXXXX. This is, in fact, what I have been trying to implement.

Am I missing something?

[guardrex]

Let me see. I have that test app here ... I'll run it and see what happens. I thought I recalled seeing it, but I might be mistaken. Stand-by ..........................

[guardrex]

Yeah, I see it. Here's a request for the Counter component. Still tho, I do want to hear back from Jeremy on this subject. I think we should say something in the article about it, even if it isn't a concern. If there are any gotchas 😈, we should call them out.

[nathan-parkinson]

Here is mine. I still see no antiforgery token.
Feel like I'm missing something obvious