Skip to content

Blazor Web (InteractiveAuto) with BFF + YARP and token exchange api call sample#384

Merged
kevinchalet merged 39 commits intoopeniddict:devfrom
m3nax:blazor-web-auto-exchange-sample
Feb 28, 2026
Merged

Blazor Web (InteractiveAuto) with BFF + YARP and token exchange api call sample#384
kevinchalet merged 39 commits intoopeniddict:devfrom
m3nax:blazor-web-auto-exchange-sample

Conversation

@m3nax
Copy link
Contributor

@m3nax m3nax commented Feb 10, 2026

Esempio blazor che fa uso di BFF with YARP e token exchange.

Pages:

  • Home page with a brief explanation of the purpose of the example
  • Unauthenticated page counter
  • Authenticated weather page that uses token exchange
  • AdminOnly page that shows how to propagate user roles to the webassembly client when InteractiveMode is enabled

Related to #367

Copy link
Member

@kevinchalet kevinchalet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this great PR! 👏🏻

transformContext.ProxyRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", exchangeResult.IssuedToken);

// Remove application cookies
transformContext.HttpContext.Request.Headers.Remove("Cookie");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess you're doing that to prevent the Cookie header from being propagated to the downstream API? If so, I'm not sure it really works as you expect (and mutating the original HttpRequest isn't ideal anyway).

Consider using transformBuilder.RequestTransforms.Add(new RequestHeaderRemoveTransform("Cookie")) instead 😃

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I retested my code without removing cookies, and now everything works. My first attempt solved some issues with the API call, but now it seems to be no longer necessary.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing the cookies isn't a bad idea at all (no point sending cookies that won't be used by the API).

Let's add transformBuilder.RequestTransforms.Add(new RequestHeaderRemoveTransform("Cookie")), it's the simplest option.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@m3nax m3nax requested a review from kevinchalet February 11, 2026 19:44
@kevinchalet kevinchalet merged commit 718a23d into openiddict:dev Feb 28, 2026
3 checks passed
@kevinchalet
Copy link
Member

Merged, thanks for your PR, @m3nax! 🎉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants