Add CookieOidcRefresher section

Author: guardrex

aspnetcore/blazor/security/blazor-web-app-with-oidc.md

@@ -232,6 +232,19 @@ Inspect the sample app for the following features:
 
 For more information on (web) API calls using a service abstractions in Blazor Web Apps, see <xref:blazor/call-web-api#service-abstractions-for-web-api-calls>.
 
+:::moniker range="< aspnetcore-10.0"
+
+<!-- UPDATE 10.0 - Check the PU issue for 10.0 work to resolve both issues.
+                   The docs issue is https://github.com/dotnet/AspNetCore.Docs/issues/34235. -->
+
+## Custom cookie refresher (`CookieOidcRefresher.cs`)
+
+The custom cookie refresher (`CookieOidcRefresher.cs`) implementation might need to be updated depending on your Identity Provider. For example, the refresher expects an ID token from the token endpoint. If the refresh token isn't an ID token with claims, the refresher can be updated with additional logic to continue to use the prior set of claims stored in the authentication cookie.
+
+Additionally, work is scheduled for .NET 10 (November, 2025) on [`BlazorWebAppOidc AddOpenIdConnect with GetClaimsFromUserInfoEndpoint = true doesn't propogate role claims to client` (`dotnet/aspnetcore` 58826)](https://github.com/dotnet/aspnetcore/issues/58826) to refresh claims from the `/userinfo` endpoint.
+
+:::moniker-end
+
 ## Client-side Blazor Web App project (`BlazorWebAppOidc.Client`)
 
 The `BlazorWebAppOidc.Client` project is the client-side project of the Blazor Web App.
@@ -520,6 +533,19 @@ Inspect the sample app for the following features:
 
 For more information on (web) API calls using a service abstractions in Blazor Web Apps, see <xref:blazor/call-web-api#service-abstractions-for-web-api-calls>.
 
+:::moniker range="< aspnetcore-10.0"
+
+<!-- UPDATE 10.0 - Check the PU issue for 10.0 work to resolve both issues.
+                   The docs issue is https://github.com/dotnet/AspNetCore.Docs/issues/34235. -->
+
+## Custom cookie refresher (`CookieOidcRefresher.cs`)
+
+The custom cookie refresher (`CookieOidcRefresher.cs`) implementation might need to be updated depending on your Identity Provider. For example, the refresher expects an ID token from the token endpoint. If the refresh token isn't an ID token with claims, the refresher can be updated with additional logic to continue to use the prior set of claims stored in the authentication cookie.
+
+Additionally, work is scheduled for .NET 10 (November, 2025) on [`BlazorWebAppOidc AddOpenIdConnect with GetClaimsFromUserInfoEndpoint = true doesn't propogate role claims to client` (`dotnet/aspnetcore` 58826)](https://github.com/dotnet/aspnetcore/issues/58826) to refresh claims from the `/userinfo` endpoint.
+
+:::moniker-end
+
 ## Client-side Blazor Web App project (`BlazorWebAppOidc.Client`)
 
 The `BlazorWebAppOidc.Client` project is the client-side project of the Blazor Web App.