Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Avoid re-running routing for implicit middlewares and remove implicit anti-forgery #50864

Merged
merged 4 commits into from
Sep 25, 2023
Merged

Avoid re-running routing for implicit middlewares and remove implicit anti-forgery #50864

merged 4 commits into from
Sep 25, 2023

Conversation

captainsafia
Copy link
Member

@captainsafia captainsafia commented Sep 21, 2023 •
edited
Loading

Description

Avoid running routing eagerly in implicit middlewares to prevents the EndpointFeature from being set and causing unexpected reactions in other middlewares, like the static file middleware.

We also remove the implicit registration of the anti-forgery middleware to avoid unintended collisions with authentication in Blazor.

Fixes #50818, #50815, #50844

Customer Impact

Without this change, the anti-forgery middleware in Blazor apps runs too early and is not able to examine authentication state in the application. Requiring the middleware to be registered explicitly ensures that the correct ordering is applied.

Without this change, users will run into difficult to resolve issues with building applications that include forms with Blazor web apps.

Regression?

  • Yes
  • No

This is a regression that was introduced to middleware routing in .NET 8 Preview 7.

Risk

  • High
  • Medium
  • Low

Medium risk because:

  • We are reverting a change that was originally applied to resolve Explicitly calling app.UseRouting() in Blazor Web App results in exception that antiforgery middleware is missing #49654. This means that the original bug will impact users, specifically those who are calling UseRouting explicitly without calling UseAuthentication and UseAuthorization if they are not available. There is a workaround that we plan to document this behavior for users.
  • Apps deployed in .NET 8 RC 1 will break because we no longer automatically enable the anti-forgery middleware. Users will receive an exception at startup notifying them of the code changes to make in order to get things working correctly.

Verification

  • Manual (required)
  • Automated

Packaging changes reviewed?

  • Yes
  • No
  • N/A

@dotnet-issue-labeler dotnet-issue-labeler bot added the needs-area-label Used by the dotnet-issue-labeler to label those issues which couldn't be triaged automatically label Sep 21, 2023
@captainsafia captainsafia added area-middleware Includes: URL rewrite, redirect, response cache/compression, session, and other general middlesware and removed needs-area-label Used by the dotnet-issue-labeler to label those issues which couldn't be triaged automatically labels Sep 21, 2023
@captainsafia captainsafia marked this pull request as ready for review September 22, 2023 19:47
@captainsafia captainsafia requested review from Tratcher, a team and halter73 as code owners September 22, 2023 19:47
@mkArtakMSFT mkArtakMSFT added the Servicing-consider Shiproom approval is required for the issue label Sep 22, 2023
@ghost
Copy link

ghost commented Sep 22, 2023

Hi @captainsafia. Please make sure you've updated the PR description to use the Shiproom Template. Also, make sure this PR is not marked as a draft and is ready-to-merge.

To learn more about how to prepare a servicing PR click here.

@viliml viliml mentioned this pull request Sep 22, 2023
Closed
1 task
@captainsafia captainsafia mentioned this pull request Sep 22, 2023
Closed
1 task
BrennanConroy
BrennanConroy approved these changes Sep 25, 2023
View reviewed changes
Copy link
Member

@BrennanConroy BrennanConroy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We really need a better way of doing all this routing magic 😢

javiercn
javiercn reviewed Sep 25, 2023
View reviewed changes
...jectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWeb-CSharp/Program.Main.cs
@@ -51,6 +51,7 @@ public static void Main(string[] args)

#endif
app.UseStaticFiles();
app.UseAntiforgery();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need this?

Blazor already does its own antiforgery check.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have a check in endpoint routing to validate that the anti-forgery middleware was properly configured for non-Blazor scenarios (see this). We could exempt Blazor from this check but I'd rather have the behavior consistent across implementations.

@mkArtakMSFT mkArtakMSFT added Servicing-approved Shiproom has approved the issue and removed Servicing-consider Shiproom approval is required for the issue labels Sep 25, 2023
@ghost
Copy link

ghost commented Sep 25, 2023

Hi @captainsafia. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed.

@mkArtakMSFT mkArtakMSFT merged commit 3dbfa81 into release/8.0-rc2 Sep 25, 2023
26 checks passed
@mkArtakMSFT mkArtakMSFT deleted the safia/fix-middlewares branch September 25, 2023 18:09
@ghost ghost added this to the 8.0-rc2 milestone Sep 25, 2023
javiercn added a commit that referenced this pull request Sep 28, 2023
@dotnet-maestro-bot @MackinnonBuck
@halter73 @BrennanConroy @wtgodbe @captainsafia @dotnet-maestro @javiercn
[automated] Merge branch 'release/8.0' => 'main' (#50973)
dba3968 
* [release/8.0-rc2] [Blazor] Make auto components prefer the existing render mode (#50851)

# Make auto components prefer the existing render mode

Ensures that if interactive components exist on the page and they all use a single render mode, components with the "Auto" render mode will also use that render mode.

## Description

It's a common requirement for state to be shared between interactive root components. For example, the `<HeadOutlet>` component, which allows updating content in the HTML `<head>`, renders content specified by a `<HeadContent>` component, if it exists. However, this only works if the `<HeadOutlet>` and `<HeadContent>` components use the same interactive render mode.

The Auto render mode lets Blazor select a "best" render mode (either Server or WebAssembly) at runtime, primarily depending on whether Blazor WebAssembly resources are cached in the browser. However, previously it did this without taking into consideration the render mode used by existing components on the page.

For example, suppose a `<HeadOutlet>` with an Auto render mode gets added to the page before WebAssembly resources have been loaded and cached, so it uses Blazor Server. Later, a `<HeadContent>` component, also with an Auto render mode, gets added to the page. But at this point, WebAssembly resources have loaded completely, so the `<HeadContent>` component uses Blazor WebAssembly. In this example, the content in the `<head>` does not update, because the `<HeadOutlet>` and `<HeadContent>` use different render modes.

This PR updates the auto render mode decision making logic to the following:
* If WebAssembly components exist on the page, use WebAssembly
* Otherwise, if Server components exist on the page, use Server
* Otherwise, if WebAssembly resources are cached, use WebAssembly
* Otherwise, use Server

Fixes #50686

## Customer Impact

Medium/high. We've seen multiple reports of the existing behavior causing problems in customer apps, and there isn't a workaround.

## Regression?

- [ ] Yes
- [X] No

This behavior has existed since the Auto render mode was introduced in an earlier .NET 8 preview release.

## Risk

- [ ] High
- [ ] Medium
- [X] Low

This PR is a small change to the Auto mode logic. It's unlikely that customers were already relying on the existing behavior.

## Verification

- [X] Manual (required)
- [X] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [X] N/A

* Add Identity Components to Blazor template (#50722)

# Add Identity Components to Blazor template

## Description

This adds the option to add Identity Razor Components (`*.razor` files) when using the Blazor project template. This supports the same feature set as the Identity Razor Pages (`*.cshtml` files). We've already done an accessibility pass over these newly added components and this PR includes all the fixes for Accessibility too. As with the Identity Razor Pages, this supports local authentication (with the option to configure external login providers) and Identity management using EF Core.

Fixes #48786

## Customer Impact

These Identity Razor Components have been a common request for years as noted above, because it allows Blazor developers to use Identity without needing to add Razor Pages infrastructure which would otherwise be unnecessary and doesn't integrate well with the rest of the app. For example, the Identity Razor Pages to a Blazor app would use a different layout that doesn't match the look and feel of the Razor Components that make up the rest of the app.

## Regression?

- [ ] Yes
- [x] No

## Risk

- [ ] High
- [ ] Medium
- [x] Low

These are template only changes that only affect the brand new Blazor project template. It should have no impact on the project template output unless you opt-in to the individual auth option (other than a [small fix](5462e42) to make the `--empty` option produce compileable output with all `InteractivityPlatform` options.)

## Verification

- [x] Manual (required)
- [x] Automated

We're also adding new validation scenarios for vendors to validate periodically.

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [x] N/A

----

- [x] Finish user management components for 2fa, external login, personal data, etc...
- [x] Add signout link
- [x] Verify RegisterOnPersisting gets invoked as expected with the changes from #50625
- [x] Render ShowRecoveryCodes.razor inline rather than via a redirect.
- [x] Add baseline tests
- [x] Fix BOMs
- [x] Validate the template in VS

* Add logging to Http.Sys tests (#50883)

* Skip failing tests (#50917)

* Avoid re-running routing for implicit middlewares and remove implicit anti-forgery (#50864)

## Description

Avoid running routing eagerly in implicit middlewares to prevents the `EndpointFeature` from being set and causing unexpected reactions in other middlewares, like the static file middleware.

We also remove the implicit registration of the anti-forgery middleware to avoid unintended collisions with authentication in Blazor.

Fixes #50818, #50815, #50844

## Customer Impact

Without this change, the anti-forgery middleware in Blazor apps runs too early and is not able to examine authentication state in the application. Requiring the middleware to be registered explicitly ensures that the correct ordering is applied.

Without this change, users will run into difficult to resolve issues with building applications that include forms with Blazor web apps.

## Regression?

- [X] Yes
- [ ] No

This is a regression that was introduced to middleware routing in .NET 8 Preview 7.

## Risk

- [ ] High
- [X] Medium
- [ ] Low

**Medium risk** because:
- We are reverting a change that was originally applied to resolve #49654. This means that the original bug will impact users, specifically those who are calling `UseRouting` explicitly without calling `UseAuthentication` and `UseAuthorization` if they are not available. There is a workaround that we plan to document this behavior for users.
- Apps deployed in .NET 8 RC 1 will break because we no longer automatically enable the anti-forgery middleware. Users will receive an exception at startup notifying them of the code changes to make in order to get things working correctly.

## Verification

- [X] Manual (required)
- [X] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [X] N/A

* [release/8.0] Update dependencies from dotnet/runtime (#50957)

* Update dependencies from https://github.com/dotnet/runtime build 20230926.15

Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting , Microsoft.SourceBuild.Intermediate.runtime.linux-x64
 From Version 8.0.0-rtm.23475.7 -> To Version 8.0.0-rtm.23476.15

* Update node version

---------

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: jacalvar <jacalvar@microsoft.com>

* [Blazor] Antiforgery fix (#50946)

# Ensure antiforgery token flows to Blazor WebAssembly

The change makes sure that we persist the Antiforgery token during prerendering so that it is available to WebAssembly components.

## Description

* When using cookie authentication it is necessary to use antiforgery protection to prevent cross-site request forgery attacks.
* Blazor Webassembly interactive components must get access to the request antiforgery token to attach it to any outgoing API call.
* The antiforgery request token was not flowing from the server to the client correctly.
* This change enables calling APIs from web assembly to the server safely.
Fixes #50900

## Customer Impact

.NET 8.0 customers who have created Blazor Web Apps will fail to call APIs from webassembly components, as they won't be able to attach the required antiforgery token.

## Regression?

- [ ] Yes
- [X] No

[If yes, specify the version the behavior has regressed from]

## Risk

- [ ] High
- [ ] Medium
- [X] Low

The fix is simple and we added an E2E test to cover the scenario.

## Verification

- [ ] Manual (required)
- [X] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [X] N/A

----

## When servicing release/2.1

- [ ] Make necessary changes in eng/PatchConfig.props

* Update dependencies from https://github.com/dotnet/runtime build 20230927.9 (#50977)

Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting , Microsoft.SourceBuild.Intermediate.runtime.linux-x64
 From Version 8.0.0-rtm.23476.15 -> To Version 8.0.0-rtm.23477.9

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

---------

Co-authored-by: Mackinnon Buck <mackinnon.buck@gmail.com>
Co-authored-by: Stephen Halter <halter73@gmail.com>
Co-authored-by: Brennan <brecon@microsoft.com>
Co-authored-by: William Godbe <wigodbe@microsoft.com>
Co-authored-by: Safia Abdalla <safia@microsoft.com>
Co-authored-by: dotnet-maestro[bot] <42748379+dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: jacalvar <jacalvar@microsoft.com>
javiercn added a commit that referenced this pull request Sep 28, 2023
@dotnet-maestro-bot @MackinnonBuck
@halter73 @BrennanConroy @wtgodbe @captainsafia @dotnet-maestro @javiercn
[automated] Merge branch 'release/8.0' => 'main' (#50993)
3f7e708 
* [release/8.0-rc2] [Blazor] Make auto components prefer the existing render mode (#50851)

# Make auto components prefer the existing render mode

Ensures that if interactive components exist on the page and they all use a single render mode, components with the "Auto" render mode will also use that render mode.

## Description

It's a common requirement for state to be shared between interactive root components. For example, the `<HeadOutlet>` component, which allows updating content in the HTML `<head>`, renders content specified by a `<HeadContent>` component, if it exists. However, this only works if the `<HeadOutlet>` and `<HeadContent>` components use the same interactive render mode.

The Auto render mode lets Blazor select a "best" render mode (either Server or WebAssembly) at runtime, primarily depending on whether Blazor WebAssembly resources are cached in the browser. However, previously it did this without taking into consideration the render mode used by existing components on the page.

For example, suppose a `<HeadOutlet>` with an Auto render mode gets added to the page before WebAssembly resources have been loaded and cached, so it uses Blazor Server. Later, a `<HeadContent>` component, also with an Auto render mode, gets added to the page. But at this point, WebAssembly resources have loaded completely, so the `<HeadContent>` component uses Blazor WebAssembly. In this example, the content in the `<head>` does not update, because the `<HeadOutlet>` and `<HeadContent>` use different render modes.

This PR updates the auto render mode decision making logic to the following:
* If WebAssembly components exist on the page, use WebAssembly
* Otherwise, if Server components exist on the page, use Server
* Otherwise, if WebAssembly resources are cached, use WebAssembly
* Otherwise, use Server

Fixes #50686

## Customer Impact

Medium/high. We've seen multiple reports of the existing behavior causing problems in customer apps, and there isn't a workaround.

## Regression?

- [ ] Yes
- [X] No

This behavior has existed since the Auto render mode was introduced in an earlier .NET 8 preview release.

## Risk

- [ ] High
- [ ] Medium
- [X] Low

This PR is a small change to the Auto mode logic. It's unlikely that customers were already relying on the existing behavior.

## Verification

- [X] Manual (required)
- [X] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [X] N/A

* Add Identity Components to Blazor template (#50722)

# Add Identity Components to Blazor template

## Description

This adds the option to add Identity Razor Components (`*.razor` files) when using the Blazor project template. This supports the same feature set as the Identity Razor Pages (`*.cshtml` files). We've already done an accessibility pass over these newly added components and this PR includes all the fixes for Accessibility too. As with the Identity Razor Pages, this supports local authentication (with the option to configure external login providers) and Identity management using EF Core.

Fixes #48786

## Customer Impact

These Identity Razor Components have been a common request for years as noted above, because it allows Blazor developers to use Identity without needing to add Razor Pages infrastructure which would otherwise be unnecessary and doesn't integrate well with the rest of the app. For example, the Identity Razor Pages to a Blazor app would use a different layout that doesn't match the look and feel of the Razor Components that make up the rest of the app.

## Regression?

- [ ] Yes
- [x] No

## Risk

- [ ] High
- [ ] Medium
- [x] Low

These are template only changes that only affect the brand new Blazor project template. It should have no impact on the project template output unless you opt-in to the individual auth option (other than a [small fix](5462e42) to make the `--empty` option produce compileable output with all `InteractivityPlatform` options.)

## Verification

- [x] Manual (required)
- [x] Automated

We're also adding new validation scenarios for vendors to validate periodically.

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [x] N/A

----

- [x] Finish user management components for 2fa, external login, personal data, etc...
- [x] Add signout link
- [x] Verify RegisterOnPersisting gets invoked as expected with the changes from #50625
- [x] Render ShowRecoveryCodes.razor inline rather than via a redirect.
- [x] Add baseline tests
- [x] Fix BOMs
- [x] Validate the template in VS

* Add logging to Http.Sys tests (#50883)

* Skip failing tests (#50917)

* Avoid re-running routing for implicit middlewares and remove implicit anti-forgery (#50864)

## Description

Avoid running routing eagerly in implicit middlewares to prevents the `EndpointFeature` from being set and causing unexpected reactions in other middlewares, like the static file middleware.

We also remove the implicit registration of the anti-forgery middleware to avoid unintended collisions with authentication in Blazor.

Fixes #50818, #50815, #50844

## Customer Impact

Without this change, the anti-forgery middleware in Blazor apps runs too early and is not able to examine authentication state in the application. Requiring the middleware to be registered explicitly ensures that the correct ordering is applied.

Without this change, users will run into difficult to resolve issues with building applications that include forms with Blazor web apps.

## Regression?

- [X] Yes
- [ ] No

This is a regression that was introduced to middleware routing in .NET 8 Preview 7.

## Risk

- [ ] High
- [X] Medium
- [ ] Low

**Medium risk** because:
- We are reverting a change that was originally applied to resolve #49654. This means that the original bug will impact users, specifically those who are calling `UseRouting` explicitly without calling `UseAuthentication` and `UseAuthorization` if they are not available. There is a workaround that we plan to document this behavior for users.
- Apps deployed in .NET 8 RC 1 will break because we no longer automatically enable the anti-forgery middleware. Users will receive an exception at startup notifying them of the code changes to make in order to get things working correctly.

## Verification

- [X] Manual (required)
- [X] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [X] N/A

* [release/8.0] Update dependencies from dotnet/runtime (#50957)

* Update dependencies from https://github.com/dotnet/runtime build 20230926.15

Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting , Microsoft.SourceBuild.Intermediate.runtime.linux-x64
 From Version 8.0.0-rtm.23475.7 -> To Version 8.0.0-rtm.23476.15

* Update node version

---------

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: jacalvar <jacalvar@microsoft.com>

* [Blazor] Antiforgery fix (#50946)

# Ensure antiforgery token flows to Blazor WebAssembly

The change makes sure that we persist the Antiforgery token during prerendering so that it is available to WebAssembly components.

## Description

* When using cookie authentication it is necessary to use antiforgery protection to prevent cross-site request forgery attacks.
* Blazor Webassembly interactive components must get access to the request antiforgery token to attach it to any outgoing API call.
* The antiforgery request token was not flowing from the server to the client correctly.
* This change enables calling APIs from web assembly to the server safely.
Fixes #50900

## Customer Impact

.NET 8.0 customers who have created Blazor Web Apps will fail to call APIs from webassembly components, as they won't be able to attach the required antiforgery token.

## Regression?

- [ ] Yes
- [X] No

[If yes, specify the version the behavior has regressed from]

## Risk

- [ ] High
- [ ] Medium
- [X] Low

The fix is simple and we added an E2E test to cover the scenario.

## Verification

- [ ] Manual (required)
- [X] Automated

## Packaging changes reviewed?

- [ ] Yes
- [ ] No
- [X] N/A

----

## When servicing release/2.1

- [ ] Make necessary changes in eng/PatchConfig.props

* Update dependencies from https://github.com/dotnet/runtime build 20230927.9 (#50977)

Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting , Microsoft.SourceBuild.Intermediate.runtime.linux-x64
 From Version 8.0.0-rtm.23476.15 -> To Version 8.0.0-rtm.23477.9

Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

* [release/8.0] Update dependencies from dotnet/efcore dotnet/extensions (#50671)

[release/8.0] Update dependencies from dotnet/efcore dotnet/extensions


 - Merge branch 'release/8.0' into darc-release/8.0-67c2f3d0-02d1-4633-b986-2922ed8a04d7

 - Update versions

 - Merge branch 'release/8.0' into darc-release/8.0-67c2f3d0-02d1-4633-b986-2922ed8a04d7

 - Merge branch 'release/8.0' into darc-release/8.0-67c2f3d0-02d1-4633-b986-2922ed8a04d7

 - Merge branch 'release/8.0' into darc-release/8.0-67c2f3d0-02d1-4633-b986-2922ed8a04d7

 - Merge branch 'release/8.0' into darc-release/8.0-67c2f3d0-02d1-4633-b986-2922ed8a04d7

 - React to namespace changes

 - More namespace changes

 - Fix up namespaces

---------

Co-authored-by: Mackinnon Buck <mackinnon.buck@gmail.com>
Co-authored-by: Stephen Halter <halter73@gmail.com>
Co-authored-by: Brennan <brecon@microsoft.com>
Co-authored-by: William Godbe <wigodbe@microsoft.com>
Co-authored-by: Safia Abdalla <safia@microsoft.com>
Co-authored-by: dotnet-maestro[bot] <42748379+dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>
Co-authored-by: jacalvar <jacalvar@microsoft.com>
@captainsafia captainsafia mentioned this pull request Sep 28, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@javiercn javiercn javiercn left review comments

@BrennanConroy BrennanConroy BrennanConroy approved these changes

@Tratcher Tratcher Awaiting requested review from Tratcher

@halter73 halter73 Awaiting requested review from halter73

Assignees
No one assigned
Labels
area-middleware Includes: URL rewrite, redirect, response cache/compression, session, and other general middlesware Servicing-approved Shiproom has approved the issue
Projects
None yet
Milestone
8.0-rc2
Development

Successfully merging this pull request may close these issues.
4 participants
@captainsafia @javiercn @BrennanConroy @mkArtakMSFT