Closed mikeirvingweb closed 1 month ago
p.s. I feel this would happen behind any form of authentication that is failing due to cookie access.
Thanks for the report. It is likely that the .NET runtime is not propagating the required cookies for authentication to work properly.
We're using this:
to fetch the runtime's assets, but it may not be enough to get everything through.
Current behavior
If you deploy to Azure Static Web Apps (a working Uno Platform WASM app)
then turn on basic "Password protection" authentication ("Standard" hosting required)
then reload your app (maybe open an Incognito / Private window, for a fully fresh experience)
you will get the Azure login screen![Screenshot 2024-07-17 at 16 13 28](https://github.com/user-attachments/assets/529ad5ea-2495-4e75-a10b-70f4804c747d)
Enter your password, hit Submit
The page starts to load, but hangs.
Open the Dev Tools (F12) and Refresh the page to see what's going on.
In the console. Lots of errors![Screenshot 2024-07-17 at 16 16 02](https://github.com/user-attachments/assets/862fc959-66e2-4994-98b4-5cfaf2f7787f)
and in the Network Tab, you will se that lots of the files in the![Screenshot 2024-07-17 at 16 19 40](https://github.com/user-attachments/assets/666ed6dd-e6b5-444c-91ec-180969beda88)
package_ ...
folder get issued a 302 redirect back to the authorisation page.If you request one of these files in a Fresh browser tab, it works
![Screenshot 2024-07-17 at 16 22 38](https://github.com/user-attachments/assets/deb5c803-334a-4b39-9b29-17c83f29c638)
This is because the fresh request can see the Auth cookie.
But the Framed / Embedded request cannot.
Here is the Azure Static Web Apps Cookie - see Application Tab in Developer Tools![Screenshot 2024-07-17 at 16 24 17](https://github.com/user-attachments/assets/e3903be4-3211-4498-b198-4aa4073bd98f)
This seems like a Browser security issue see: https://stackoverflow.com/questions/68788202/page-within-iframe-not-seeing-its-own-cookies
--
I have tried various settings in my
staticwebapp.config.json
file to try to alleviate this, namely:"allowedRoles": "authenticated"
, some as"allowedRoles": "anonymous"
to no resolution.
--
it would appear, given the browser security settings, this would happen on other web hosting services that are looking for a cookie too.
Any suggestions?
Expected behavior
a WASM deployed app would work, behind authentication
How to reproduce it (as minimally and precisely as possible)
No response
Workaround
No response
Works on UWP/WinUI
Yes
Environment
No response
NuGet package version(s)
No response
Affected platforms
WebAssembly
IDE
No response
IDE version
No response
Relevant plugins
No response
Anything else we need to know?
No response