Update Secure an ASP.NET Core Blazor Web App with OpenID Connect (OIDC) to demonstrate Access Token Management

9.0/BlazorWebAppOidc/BlazorWebAppOidc/BlazorWebAppOidc.csproj

@@ -8,6 +8,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\BlazorWebAppOidc.Client\BlazorWebAppOidc.Client.csproj" />
+    <PackageReference Include="Duende.AccessTokenManagement.OpenIdConnect" Version="4.0.0-rc.2" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="9.0.0" />
     <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="9.0.0" />
   </ItemGroup>

9.0/BlazorWebAppOidc/BlazorWebAppOidc/CookieEvents.cs

@@ -0,0 +1,26 @@
+using Duende.AccessTokenManagement.OpenIdConnect;
+using Microsoft.AspNetCore.Authentication.Cookies;
+
+namespace BlazorWebAppOidc;
+
+/// <summary>
+/// Automatically validates the token.
+/// See https://docs.duendesoftware.com/accesstokenmanagement/blazor-server/ for more information.
+/// </summary>
+public class CookieEvents : CookieAuthenticationEvents
+{
+    private readonly IUserTokenStore _store;
+
+    public CookieEvents(IUserTokenStore store) => _store = store;
+
+    public override async Task ValidatePrincipal(CookieValidatePrincipalContext context)
+    {
+        var token = await _store.GetTokenAsync(context.Principal!);
+        if (!token.Succeeded)
+        {
+            context.RejectPrincipal();
+        }
+
+        await base.ValidatePrincipal(context);
+    }
+}

9.0/BlazorWebAppOidc/BlazorWebAppOidc/OidcEvents.cs

@@ -0,0 +1,38 @@
+using Duende.AccessTokenManagement;
+using Duende.AccessTokenManagement.OpenIdConnect;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+
+namespace BlazorWebAppOidc;
+
+/// <summary>
+/// Stores access token and refresh token in the server-side token store once a token is validated.
+/// See https://docs.duendesoftware.com/accesstokenmanagement/blazor-server/ for more information.
+/// </summary>
+public class OidcEvents : OpenIdConnectEvents
+{
+    private readonly IUserTokenStore _store;
+
+    public OidcEvents(IUserTokenStore store) => _store = store;
+
+    public override async Task TokenValidated(TokenValidatedContext context)
+    {
+        var exp = DateTimeOffset.UtcNow.AddSeconds(double.Parse(context.TokenEndpointResponse!.ExpiresIn));
+
+        await _store.StoreTokenAsync(context.Principal!, new UserToken
+        {
+            AccessToken = AccessToken.Parse(context.TokenEndpointResponse.AccessToken),
+            AccessTokenType = AccessTokenType.Parse(context.TokenEndpointResponse.TokenType),
+            RefreshToken = RefreshToken.Parse(context.TokenEndpointResponse.RefreshToken),
+            Scope = !string.IsNullOrEmpty(context.TokenEndpointResponse.Scope)
+                ? Scope.Parse(context.TokenEndpointResponse.Scope)
+                : Scope.Parse(string.Join(" ", context.Options.Scope)),
+            ClientId = !string.IsNullOrEmpty(context.ProtocolMessage.ClientId)
+                ? ClientId.Parse(context.ProtocolMessage.ClientId)
+                : ClientId.Parse(context.Options.ClientId!),
+            IdentityToken = IdentityToken.Parse(context.TokenEndpointResponse.IdToken),
+            Expiration = exp,
+        });
+
+        await base.TokenValidated(context);
+    }
+}