Proxy-based API Access

This page publishes the canonical host-side proxy guidance used by the recommended server-side application model.

Use this configuration when the ASP.NET Core host should authenticate the user and proxy downstream API traffic on the user's behalf.

Recommended package role

Recrovit.RecroGridFramework.Client.Blazor.Host.OpenIdConnect is the recommended app-level entry point for the host/proxy application model.

It combines:

the reusable OpenID Connect host infrastructure;
the SessionAuth SSR registration;
the downstream proxy endpoint wiring used by RecroGrid Framework applications;
the Razor Components host setup needed by the shared Blazor application.

Host registration

builder.AddRgfBlazorServerProxyOpenIdConnectRazorComponents();
builder.AddRgfBlazorServerProxyOpenIdConnectHost();

Endpoint mapping

app.MapRgfBlazorServerProxyOpenIdConnectEndpoints("/not-found");
app.MapRgfBlazorServerProxyOpenIdConnectComponents<App>(typeof(BlazorApp.Client._Imports).Assembly);

This setup maps:

the host authentication endpoints;
the generic downstream proxy endpoints;
the RGF-specific proxy routes used by existing applications.

Minimal configuration

Configure the host-facing OpenID Connect behavior under Recrovit:OpenIdConnect:Host and the downstream API under Recrovit:OpenIdConnect:DownstreamApis:RgfApi.

{
  "Recrovit": {
    "OpenIdConnect": {
      "Provider": "MainProvider",
      "Providers": {
        "MainProvider": {
          "Authority": "https://idp.example.com",
          "ClientId": "client-id",
          "ClientSecret": "client-secret",
          "Scopes": [ "openid", "profile", "offline_access" ],
          "CallbackPath": "/signin-oidc",
          "SignedOutRedirectPath": "/"
        }
      },
      "DownstreamApis": {
        "RgfApi": {
          "BaseUrl": "https://rgf-api-app.example.com",
          "Scopes": [ "api.scope" ]
        }
      }
    },
    "RecroGridFramework": {
      "API": {
        "ProxyBaseAddress": "https://app-host.example.com"
      }
    }
  }
}

Production requirements

Before production deployment, verify at minimum: