Blazor 9's AddAuthenticationStateSerialization() and AddAuthenticationStateDeserialization() appear to lack support for external API JWT authentication scenarios

[shahabfar]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

The methods AddAuthenticationStateSerialization() and AddAuthenticationStateDeserialization() appear to only function correctly when using ASP.NET Core Identity in the server project (as used in the Visual Studio sample templates).

When using a remote API for authentication with JWT tokens, these methods do not seem to provide automatic persistent serialization of the authentication state. Since the developers need to implement a custom AuthenticationStateProvider to handle JWT persistence, reducing the utility of these new serializer methods in non-Identity scenarios.

This limitation makes it more challenging to integrate with remote API-based authentication strategies and adds additional development overhead.

Describe the solution you'd like

A new sample should be added to the existing Blazor samples to demonstrate how to use an external API for JWT authentication while employing prerendering authentication, as well as how to transfer the authentication state to the interactive rendering mode.
Although one workaround is to create a custom AuthenticationStateProvider as before and include some boilerplate code to manage the persisted component state, it seems that AddAuthenticationStateSerialization() and AddAuthenticationStateDeserialization() were introduced specifically to eliminate the need for such custom providers.

Additional context

No response

[mkArtakMSFT]

Thanks for contacting us. The two mentioned APIs rely on having the authentication state on the server (cookies basically) to work.
For what you're trying to achieve we recommend using the BFF (backend for frontend) pattern, where the client will call the server (utilizing Cookie-based auth) and the server will redirect the call to the API with JWT.

[shahabfar]

@mkArtakMSFT
Thank you,
I achieved what I wanted. Now I can handle user authentication using an external API that returns a JWT (access token) upon successful authentication. The login Razor page of my Blazor WebApp project (in auto-rendering mode) is a static SSR page. The authentication state is then transferred to the interactive rendering mode using the new Blazor 9.0 APIs: AddAuthenticationStateSerialization() and AddAuthenticationStateDeserialization().

Here is my solution as a minimal repo, which demonstrates how these features can be implemented.