Blazor Server Reverse Proxy with Authentication

0
votes

I have a blazor server-side application (netcore 3) which uses authentication through OpenID / Okta.

I started testing it through IIS, and running it as a regular website worked just fine.

But, I need to run it through a reverse proxy due to the rest of our setup, and after I set that up the blazor site no longer functions.

Our reverse proxy is simple, just takes a url (https: //subdomain.domain.com), and routes it internally (http: //localhost:8093). There are other sites connected here, this was just an example.

I managed to get all the resources (css, js, images) working correctly by adding the "app.UseForwardedHeaders", but I am still having an issue with Authentication.

For Authentication, it's setup with services.AddAuthentcation, and AddOpenIdConnect, which is triggered by an MVC call to Account/Login, that issues the HttpContext.ChallengeAsync.

Running the application standalone, or in it's website, the Login works, and redirects to Okta (https: //oktadevurl.com/oauth2/default/v1/authorize?parameters).

Through the reverse proxy, this url becomes relative to the Proxy address (https: //subdomain.domain.com/oauth2/default/v1/authorize?parameters) which is incorrect.

I've double checked the forward headers, and OpenId / Okta settings. I'm looking for anyone who has had this issue before and could point me in the right direction on how to get the absolute urls working from blazor through the reverse proxy.

Thanks.

1
asp.net-coreiisblazor
what's the correct url ? - agua from mars
it should be going to https: //oktadevurl.com/oauth2/default/v1/authorize, but the host of the url gets rewritten, which turns it into the incorrect relative url. - Svelluto

1 Answers

0
votes

I was able to solve this with one little checkbox is ARR:

In IIS Manager, Select the current server (not the website), open Application Request Routing, and on the right hand column there will be an option Server Proxy Settings. There you will see "Reverse rewrite host in response headers" option. If that is checked - uncheck it and your problem should be solved.