Blazor WASM and IdentityServer4 - AuthenticationState out of sync when using multiple tab pages in chromium

[njannink]

Defect description

We have the following defect when opening our blazor website in multiple chrome tab pages. That when you logout and login a different user in the second tab this isn't notified in the first tab so the first tab displays the wrong logged-in user and that can make things confusing.

Repro scenario

• Start blazor wasm website with IdentityServer4 as authentication provider
• Open page in tab1 of chrome and login "User 1"
• Open page in tab2 of chrome and see that "User 1" is logged in and logout this user
• No notification in tab1 that user is logged out AuthenticationStateProvider.AuthenticationStateChanged is not triggered
• Try to do something in tab1 gives "Not authorized" because no user logged in

What do I need to change in my configuration so a notification is send to the first tab page that the user was logged out / logged in in a different tabpage in chrome? If there is no out of the box solution for this I might add a custom SignalR event to send this notification.

In my current setup I user the default `builder.Services.AddApiAuthorization();'

[javiercn]

@njannink thanks for contacting us.

I'm not sure we support this explicitly.

I believe this should work automatically though OpenID Connect session management (which works through an iframe).

We don't trigger any notification, but we poll the underlying JS interop layer about once per minute I believe and we subscribe to userSignedOut in the oidc-client.js library, so it should eventually propagate to other tabs I think.

[njannink]

I don't see any updates in first tab also not after a minute.

[javiercn]

I happen to be working on the IdentityServer4 update, so I'll give it a quick try to see if there is something easy we can do to enable this.

[ghost]

Thanks for contacting us.
We're moving this issue to the Next sprint planning milestone for future evaluation / consideration. We will evaluate the request when we are planning the work for the next milestone. To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

[ghost]

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

[mtavares628]

It's been almost a year since this was moved to the Backlog. Is there any movement on this where we can expect it in .NET 6? And if not, is there a suggested workaround, so that logging out of an app from one tab can notify the other tabs?

[javiercn]

This is not something that oidc-client.js supports out of the box.

Very likely this requires a custom auth implementation that notifies other apps in the same browser using something like https://developer.mozilla.org/en-US/docs/Web/API/BroadcastChannel

[ghost]

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

[mkArtakMSFT]

Closing this as the work will be covered by #40764 and the link will hopefully give enough context for the remaining work there to consider the scenario.