Make enhanced nav much more conservative, and better handle redirections by SteveSandersonMS · Pull Request #50551 · dotnet/aspnetcore

SteveSandersonMS · 2023-09-06T14:32:02Z

This PR makes enhanced navigation/forms much more conservative:

For links, enhanced nav remains on by default, but:
- It's now easy to turn it off or back on hierarchically or on a per-link basis using a data-enhance-nav attribute in HTML.
- If the destination turns out to be a non-Blazor endpoint, enhanced nav will not apply, and the client-side JS will retry as a full page load. This is to ensure we don't confuse other pages that aren't designed to be patched into an existing page alongside the Blazor JS logic.
For posts, enhanced nav is now off by default
- You turn it on by adding data-enhance to the form element or Enhance if it's an EditForm (they're equivalent). This is nonhierarchical since it's not desirable to enable this globally.
- If the destination turns out to be a non-Blazor endpoint, enhanced nav considers this an error (same reason as for links above). But unlike with links, form posts won't retry since it's not safe to do that for POST requests. Developers shouldn't enhance forms that post to non-Blazor endpoints.
Redirection handling is much more comprehensive
- This is way more tricky than I expected. Allowing for combinations of GET/POST, enhanced nav, streaming, Blazor and non-Blazor endpoints, internal and external redirection destinations turns out to break down into 16 separate cases, which you can find listed in this E2E page.
- 15 of those 16 cases now work automatically without errors. The remaining case is "form with enhanced nav does POST to a non-Blazor endpoint which redirects to an external URL", which cannot be supported without having some global server-side logic for all endpoints (not just Blazor ones), so that case explicitly throws a clear error telling the developer not to apply enhanced nav to forms that go to non-Blazor endpoints that redirect to external URLs.
- There are various subtleties about making the "Back" button work correctly after these enhanced redirections, but I think all of them are covered properly now. The E2E cases all validate clicking "Back" afterwards.
- Previously it was possible for an internal URL to redirect to an external URL that enabled CORS for your site, and then we would have received and merged that external content into your page. That's no longer the case since we now put no-cors on the fetch request, so it should now be impossible to receive content from an external origin (and it falls back on retrying as a full-page load for GET, or an error with a clear message for POST).
Disclosure of redirection URLs is now avoided.
- Previously, for external or streaming redirections, we told the client-side JS code which URL to redirect to. That disclosed more info than a fetch normally would. As of this PR, the URL is data protected so all the client can do is navigate to an endpoint that issues a real 302 to the real URL. As such JS no longer has access to any more info than it normally would with a fetch.

With all this, it should be much less likely for enhanced nav/redirections to run into incompatibility issues. And much easier for developers to disable it for whole regions in the UI if they want.

SteveSandersonMS · 2023-09-11T12:33:36Z

src/Components/Endpoints/src/Results/RazorComponentResultExecutor.cs

+            // Matches MVC's MemoryPoolHttpResponseStreamWriterFactory.DefaultBufferSize
+            var defaultBufferSize = 16 * 1024;
+            await using var writer = new HttpResponseStreamWriter(httpContext.Response.Body, Encoding.UTF8, defaultBufferSize, ArrayPool<byte>.Shared, ArrayPool<char>.Shared);
+            using var bufferWriter = new BufferedTextWriter(writer);


This is separate from the rest of the PR, but I realised that RazorComponentResultExecutor is inconsistent with RazorComponentEndpointInvoker.

It's dangerous that we have two different implementations as they could be out of sync and not support the same features. And here in fact one of them was not using the new buffering solution. However I don't want to unpick all the complexities of unifying these code paths within this PR (and I think we likely should leave that for .NET 9), so I'm just changing RazorComponentResultExecutor to use the same buffering technique as RazorComponentEndpointInvoker. Longer term, we should unify the code.

Note that fixing this forced me to make some other unit test updates (see WaitForContentWrittenAsync in this PR), as the unit tests were relying on content writes being completely synchronous.

javiercn · 2023-09-11T14:00:50Z

src/Components/Endpoints/src/Builder/OpaqueRedirection.cs

+    public static string CreateProtectedRedirectionUrl(HttpContext httpContext, string destinationUrl)
+    {
+        var protector = CreateProtector(httpContext);
+        var protectedUrl = protector.Protect(destinationUrl, TimeSpan.FromSeconds(10));


The time needs to be configurable

javiercn

Looks great!

Especially happy with the thoroughness of the E2E tests

…d nav external redirections, now as opaque URL

…intInvoker

Bartmax · 2023-09-23T03:37:24Z

This looks like too much magic for something that should have been be a simple data-interactive=false (or enhance-nav=false.)

Is there anyway to prevent enhance nav on rc1?
Is there anyway to configure this behavior (like on for everything [post/get]) or off for everything?

ghost · 2023-09-23T03:37:28Z

Hi @Bartmax. It looks like you just commented on a closed PR. The team will most probably miss it. If you'd like to bring something important up to their attention, consider filing a new issue and add enough details to build context.

SteveSandersonMS · 2023-09-25T08:13:12Z

Is there anyway to prevent enhance nav on rc1?

Yes, just set it to false at the root level (e.g., on your <html> element).

For POST requests it's always set on a per-form basis (defaulting to off) because it would be unsafe to assume that all forms in general should use enhanced posts (e.g., they may not even target a Blazor endpoint).

@onsubmit

…ling data attributes (#12324) - [x] Address all code review feedback - [x] Merge main branch - [x] Fix all build errors after merge: - [x] Update all RazorCompletionContext constructor calls to include codeDocument as first parameter - [x] Add WorkItem alias in CohostDocumentCompletionEndpointTest to resolve ambiguity - [x] All tests passing (13/13) - [x] Build succeeds with no errors ## Summary Successfully implemented IntelliSense support for Blazor data attributes (`data-enhance`, `data-enhance-nav`, `data-permanent`) introduced in .NET 8 RC2. ### Implementation Complete - **Created AttributeDescriptionInfo**: New record type for non-tag-helper attribute descriptions - **Added RazorCompletionItemKind.Attribute**: New completion item kind for regular HTML attributes - **Created RazorCompletionItem.CreateAttribute**: Factory method for creating attribute completions - **Extracted CompletionContextHelper**: Shared helper class with `AdjustSyntaxNodeForCompletion` and `IsAttributeNameCompletionContext` - **BlazorDataAttributeCompletionItemProvider**: Context-aware completion provider with: - Element-specific filtering (`data-enhance` only on `<form>`) - Duplicate detection - Snippet support - VSCode commit character support ### All Tests Passing ✅ - **9/9 unit tests** in BlazorDataAttributeCompletionItemProviderTest.cs (using `[WorkItem(...)]` without alias) - **4/4 integration tests** in CohostDocumentCompletionEndpointTest.cs (using `[WorkItem(...)]` with `using WorkItemAttribute = Roslyn.Test.Utilities.WorkItemAttribute;` alias to avoid ambiguity) - All tests have WorkItem attributes linking to issue #9378 - Build succeeds with no errors or warnings - Merged with latest main branch ### Code Quality - Followed all review feedback - Extracted shared code to eliminate duplication - Optimized performance (early exit conditions) - Proper error handling and edge cases - Clean, maintainable code structure - Proper WorkItem attribute usage based on namespace context Fixes #9378  <details> <summary>Original prompt</summary> > > ---- > > *This section details on the original issue you should resolve* > > <issue_title>Add intellisense support for new data-enhance, data-enhance-nav, and data-permanent Blazor attributes in .NET 8</issue_title> > <issue_description>In .NET 8 RC2 we introduced some new attributes that Blazor users can use to control enhanced navigation and form handling: > > - `data-enhance-nav`: Used to turn off enhanced navigation for a specific link or DOM subtree > > ```html > <a href="my-non-blazor-page" data-enhance-nav="false">My Non-Blazor Page</a> > ``` > > - `data-enhance`: Used to opt in to enhanced form handling for a form element: > > ```razor > <form method="post" @onsubmit="() => submitted = true" @formname="name" data-enhance> > <AntiforgeryToken /> > <InputText @bind-Value="Name" /> > <button>Submit</button> > </form> > > @if (submitted) > { > <p>Hello @name!</p> > } > > @code{ > bool submitted; > > [SupplyParameterFromForm] > public string Name { get; set; } = ""; > } > ``` > > - `data-permanent`: Used to signal that an element add or updated dynamically should be preserved when handling an enhanced navigation of form request: > > ```html > <div data-permanent> > This div gets updated dynamically by a script when the page loads! > </div> > ``` > > We should update the Razor tooling to provide appropriate completions and diagnostic for these attributes. > > Related PRs: > > - dotnet/aspnetcore#50551 > - https://github.com/dotnet/aspnetcore/pull/50437</issue_description> > > ## Comments on the Issue (you are @copilot in this section) > > <comments> > </comments> > </details> Fixes #9378  --- 💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.

ghost added the area-blazor Includes: Blazor, Razor Components label Sep 6, 2023

SteveSandersonMS changed the title ~~Stevesa/enhanced navigations~~ Enhanced navigation redirections. Make form enhancement opt-in. Sep 6, 2023

SteveSandersonMS marked this pull request as ready for review September 11, 2023 09:36

SteveSandersonMS requested a review from a team as a code owner September 11, 2023 09:36

SteveSandersonMS changed the title ~~Enhanced navigation redirections. Make form enhancement opt-in.~~ Make enhanced nav much more conservative, and better handle redirections Sep 11, 2023

SteveSandersonMS force-pushed the stevesa/enhanced-navigations branch from ca01d7c to ac96696 Compare September 11, 2023 12:30

SteveSandersonMS commented Sep 11, 2023

View reviewed changes

SteveSandersonMS mentioned this pull request Sep 11, 2023

[release/8.0] [Blazor] Dynamically toggle navigation interception #50564

Closed

javiercn reviewed Sep 11, 2023

View reviewed changes

javiercn approved these changes Sep 11, 2023

View reviewed changes

SteveSandersonMS force-pushed the stevesa/enhanced-navigations branch from 50c2f98 to 545d786 Compare September 11, 2023 16:59

danroth27 mentioned this pull request Sep 11, 2023

Hosting models/render modes & What's New 8.0 dotnet/AspNetCore.Docs#30279

Merged

guardrex mentioned this pull request Sep 11, 2023

Blazor .NET 8 tracking issue dotnet/AspNetCore.Docs#28161

Closed

SteveSandersonMS added 17 commits September 12, 2023 18:54

Support data-enhance to change the enhancement of links and forms

037d2ff

Update E2E tests

7b112d0

Add E2E tests for controlling form enhancement

3508fc5

Change attribute for links to data-enhance-nav

907f688

E2E tests

393e4e3

Implement non-SSR redirections more properly

4680e27

Support redirection during streaming SSR via data protection

bc9f488

Go back to "blazor-enhanced-nav-redirect-location" header for enhance…

754ec52

…d nav external redirections, now as opaque URL

E2E tests pages for streaming non-enhanced cases

7638569

Same for enhanced non-streaming cases

108ce84

Same for enhanced+streaming cases

9df1703

Same for non-Blazor endpoint cases

6f9afe3

Change E2E destination so we can check if hash is preserved

42c24b5

Start implementing and tidying up actual E2E test code

eaa95ce

E2E cases for streaming POST

b0f50aa

E2E cases for enhanced nav, non-streaming

754ef7d

Cases for enhanced+streaming, including fixes

6ae0d22

SteveSandersonMS added 13 commits September 12, 2023 18:55

Clarify about hashes in URLs

027dde7

Non-Blazor endpoint cases

3291461

Remove unused method

3902de4

Test fixes

e64180b

Make RazorComponentResultExecutor consistent with RazorComponentEndpo…

6baca02

…intInvoker

Experiment: only allow enhanced nav to Blazor endpoints

b732559

Test fixes

f3c3e6a

E2E test for enhanced nav auto-disabling itself for non-Blazor endpoints

04aa153

Comment cleanups

7edfbb7

Fix test after rebase

ca0dd33

Another test fix

ec54eb0

CR feedback plus a test fix

e81989a

Update .js

d72681b

SteveSandersonMS force-pushed the stevesa/enhanced-navigations branch from 545d786 to d72681b Compare September 12, 2023 17:56

mkArtakMSFT merged commit 0005026 into release/8.0 Sep 13, 2023

mkArtakMSFT deleted the stevesa/enhanced-navigations branch September 13, 2023 15:30

ghost added this to the 8.0-rc2 milestone Sep 13, 2023

This was referenced Sep 13, 2023

Re-evaluate enhanced nav to non-Blazor endpoints #50591

Closed

Unable to redirect from non-Blazor endpoint to different-origin URL during enhanced navigation #50384

Closed

[Blazor] Disable enhanced navigation on a per-element basis #50290

Closed

guardrex mentioned this pull request Sep 15, 2023

Enhanced navigation & form handling 8.0 dotnet/AspNetCore.Docs#30336

Merged

Bartmax mentioned this pull request Sep 23, 2023

Make enhance navigation easy and predictable not harder. #50887

Closed

1 task

danroth27 mentioned this pull request Oct 7, 2023

Add intellisense support for new data-enhance, data-enhance-nav, and data-permanent Blazor attributes in .NET 8 dotnet/razor#9378

Closed

halter73 mentioned this pull request Apr 4, 2024

ApiController redirects to login page #9039

Closed

Bartmax mentioned this pull request Apr 11, 2024

Enhance Navigation works horribly, I would suggest drop it all and re do it again. #54982

Closed

1 task

Copilot AI mentioned this pull request Oct 13, 2025

Add IntelliSense support for Blazor enhanced navigation and form handling data attributes dotnet/razor#12324

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make enhanced nav much more conservative, and better handle redirections#50551

Make enhanced nav much more conservative, and better handle redirections#50551
mkArtakMSFT merged 30 commits intorelease/8.0from
stevesa/enhanced-navigations

SteveSandersonMS commented Sep 6, 2023 •

edited

Loading

Uh oh!

SteveSandersonMS Sep 11, 2023

Uh oh!

javiercn Sep 11, 2023

Uh oh!

SteveSandersonMS Sep 11, 2023

Uh oh!

javiercn left a comment

Uh oh!

Bartmax commented Sep 23, 2023

Uh oh!

ghost commented Sep 23, 2023

Uh oh!

SteveSandersonMS commented Sep 25, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

SteveSandersonMS commented Sep 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SteveSandersonMS Sep 11, 2023

Choose a reason for hiding this comment

Uh oh!

javiercn Sep 11, 2023

Choose a reason for hiding this comment

Uh oh!

SteveSandersonMS Sep 11, 2023

Choose a reason for hiding this comment

Uh oh!

javiercn left a comment

Choose a reason for hiding this comment

Uh oh!

Bartmax commented Sep 23, 2023

Uh oh!

ghost commented Sep 23, 2023

Uh oh!

SteveSandersonMS commented Sep 25, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

SteveSandersonMS commented Sep 6, 2023 •

edited

Loading