Table of Contents

Configure SessionAuth

This step configures the session-based authentication model used by the recommended server-side application architecture.

Use SessionAuth when the browser should stay on the host origin and the host should own authentication and downstream API access.

What SessionAuth adds

Recrovit.RecroGridFramework.Client.Blazor.SessionAuth extends the base Blazor integration with:

  • route-aware authorization wrapping for RecroGrid Framework routes;
  • session probing against the configured host authentication session endpoint;
  • authenticated principal snapshot synchronization;
  • session-aware authentication state handling;
  • SSR cookie forwarding for host-originated RecroGrid Framework requests.

Registration entry points

The package exposes two registration APIs:

  • AddRgfBlazorSessionAuthClientServices(...) for the interactive client;
  • AddRgfBlazorSessionAuthSsrServices(...) for SSR-capable host integrations.

Interactive client configuration

builder.Services.AddRgfBlazorSessionAuthClientServices(
    builder.Configuration,
    apiBaseAddressOverride: builder.HostEnvironment.BaseAddress);

This registers the client in ServerProxy auth mode and keeps the effective API base address on the host origin.

Route configuration

Use RecrovitRoutes for the client route shell so the SessionAuth route wrapper can enforce authentication behavior consistently.

<RecrovitRoutes Kind="RecrovitRoutesKind.Client"
                AppAssembly="typeof(_Imports).Assembly"
                DefaultLayout="typeof(MainLayout)"
                NotFoundPage="typeof(Pages.NotFound)" />

Runtime behavior

At runtime, SessionAuth uses the host authentication endpoints to:

  • validate whether the current session is still usable;
  • rebuild the current principal state for the interactive client;
  • redirect protected routes to the login endpoint when reauthentication is required.

The built-in endpoints it depends on are typically exposed under /authentication:

  • GET /authentication/login
  • POST /authentication/logout
  • GET /authentication/session
  • GET /authentication/principal

When not to use SessionAuth

If the browser should call the API directly with bearer tokens, use the standalone WebAssembly bearer-token integration instead of SessionAuth.

Next step