Refresh token during http request in Blazor Interactive Server with OIDC

[bpsc-wkubis]

Describe the issue

In the Blazor Web App (Interactive server), the token refresh process occurs during the OnValidatePrincipal cookie event. This event is triggered if the access token is less than 5 minutes away from expiration. However, this event only executes during a complete page reload.

A potential issue arises when a user reloads the page 6 minutes prior to the access token's expiration. In this case, the OnValidatePrincipal event does not refresh the token. If the user continues to interact with the website without a full page reload, the token may expire after 6 minutes. Consequently, all subsequent API requests are rejected. The question is how to handle such a scenario.

To Reproduce

1. Set up an OIDC server with a short access token lifetime (e.g., 30 seconds) for demonstration purposes.
2. Create a protected API that validates the access token.
3. Use the BlazorWebAppOidc sample as the client.
4. Add a simple action to BlazorWebAppOidc that requests a protected API endpoint.
5. Refresh the BlazorWebAppOidc app, wait for 30 seconds, and without refreshing the app again, try to request the API.

Expected behavior

The common solution to this issue is to refresh the token during an HTTP request with a DelegatingHandler. However, in our scenario, we cannot override the cookie inside the DelegatingHandler. The expected behavior, therefore, is to be able to refresh tokens in the DelegatingHandler while storing them in cookies. If there's a way to override the cookie inside the DelegatingHandler that I'm not aware of, that could also be a potential solution.

---

Issue Details

⚠ Do not edit this section. It is required for issue processing.

• Content Source: dotnet/blazor-samples
• GitHub Login: @guardrex

[guardrex]

The best bet to get Stephen's eyes on this ... Stephen Halter built this sample ... is to open it for the product unit. Can you place that into an issue here ...

https://github.com/dotnet/aspnetcore/issues

... and reference the sample app with this link ....

https://github.com/dotnet/blazor-samples/tree/main/8.0/BlazorWebAppOidc

... and also provide a cross-link to this issue so that we don't lose track of things ...

Add .........

cc: @guardrex https://github.com/dotnet/blazor-samples/issues/267

... to the bottom of your opening comment.

Leave this issue open. We'll see where things go with your PU issue on their repo and possible track changes here for the sample app. Otherwise, I'll end up closing this later and opening a docs issue if we end up covering something in the article.

[guardrex]

Based on that answer, I think we should work this from a docs repo issue. This isn't going to be something that the sample is going to address. We can have additional guidance on it in the article.

I'll open that issue now and ping u on it.