Fix Blazor passkey registration under CsrfProtection by Copilot · Pull Request #67589 · dotnet/aspnetcore

Copilot · 2026-07-03T15:46:48Z

You've read the Contributor Guide and Code of Conduct.
You've included unit or integration tests for your change, where applicable.
You've included inline docs for your change, where applicable.
There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Make Blazor passkey registration work with CsrfProtection

Description

The scaffolded Blazor Individual auth passkey flow was still using the classic antiforgery token-cookie path. Under the new fetch-metadata CsrfProtection middleware, that cookie is never issued, so the passkey option endpoints returned 500s before the browser could complete registration.

Passkey endpoints: Removed the classic IAntiforgery.ValidateRequestAsync checks from the scaffolded /Account/PasskeyCreationOptions and /Account/PasskeyRequestOptions endpoints so they rely on the middleware-provided CSRF protection.
Passkey UI: Removed the antiforgery token plumbing from the shared passkey submit component and script, so the browser no longer sends the old requestverificationtoken header for these requests.
Regression coverage: Added a template-level regression test to lock in the new passkey antiforgery behavior.

javiercn

@copilot we need to validate the CSRF feature / item in the HttpContext is valid and has passed. The endpoint must be annotated with requires antiforgery

Copilot · 2026-07-03T16:50:29Z

@copilot we need to validate the CSRF feature / item in the HttpContext is valid and has passed. The endpoint must be annotated with requires antiforgery

Updated the scaffolded passkey endpoints to opt into the new CSRF validation path by applying [RequireAntiforgeryToken] to both POST endpoints, so they now require the middleware-provided antiforgery validation. This is covered in commit fa8f11e.

javiercn · 2026-07-03T16:54:41Z

Reviewed against main. The removal of the classic antiforgery plumbing correctly matches the root cause of #67588 — the fetch-metadata CsrfProtectionMiddleware never issues the .AspNetCore.Antiforgery.* cookie, so IAntiforgery.GetTokens/ValidateRequestAsync on the passkey option endpoints was doomed to 500. Dropping it from IdentityComponentsEndpointRouteBuilderExtensions.cs, PasskeySubmit.razor, and PasskeySubmit.razor.js is the right direction. The JS no longer references the removed request-token-* attributes, so nothing dangles.

Blocking concern: after this change these two endpoints appear to have no CSRF protection at all.

CsrfProtectionMiddleware only enforces when the matched endpoint carries IAntiforgeryMetadata with RequiresValidation: true; otherwise it calls _next(context) and skips validation (src/DefaultBuilder/src/Internal/CsrfProtectionMiddleware.cs — if (antiforgeryMetadata is not { RequiresValidation: true }) return _next(context);).

Minimal-API endpoints acquire that metadata (AntiforgeryMetadata.ValidationRequired) only when the handler reads a form: in RequestDelegateFactory.cs, InferAntiforgeryMetadata(factoryContext) is called exclusively inside if (factoryContext.ReadForm). But /Account/PasskeyCreationOptions and /Account/PasskeyRequestOptions bind HttpContext + [FromServices] + [FromQuery] only — no [FromForm]. They also don't carry [RequireAntiforgeryToken] and the MapGroup("/Account") has no .RequireAntiforgery(). So no RequiresValidation:true metadata is present, and the middleware passes them through unvalidated.

This is exactly the framework's own documented behavior: in src/DefaultBuilder/test/Microsoft.AspNetCore.Tests/CsrfProtectionIntegrationTests.cs, an endpoint mapped without antiforgery metadata returns "passthrough" (200) on a cross-site request — the helper comment states "passthrough" means "CSRF middleware skipped because metadata is missing or RequiresValidation = false". Only the [RequireAntiforgeryToken]-annotated variant returns 400 on a cross-site POST.

Net: the explicit ValidateRequestAsync was the only CSRF check on these handlers (they were annotated precisely because they don't post a form), and nothing replaces it. A forged cross-site POST to PasskeyCreationOptions (which acts on the signed-in context.User) would now succeed. To actually "rely on the middleware-provided CSRF protection" as the description states, the endpoints need to opt in — e.g. .RequireAntiforgery() on each MapPost (or on the accountGroup, taking care not to break the [FromForm] endpoints that already validate), which stamps RequiresValidation:true and lets CsrfProtectionMiddleware enforce.

Test adequacy: BlazorWebTemplate_PasskeyFlowDoesNotUseClassicAntiforgery only does Assert.DoesNotContain string-grep over the template files. It proves the classic path was removed but asserts nothing about whether CSRF is still enforced — it would stay green in the unprotected state above. Recommend a behavioral test that boots the template app and verifies (a) a cross-site request (Sec-Fetch-Site: cross-site, or mismatched Origin) to both passkey endpoints is rejected with a 4xx, and (b) a same-origin request (Sec-Fetch-Site: same-origin/none) is accepted. That directly proves "the check has happened," which the current test does not.

Refs #67588.

javiercn · 2026-07-03T16:57:08Z

@copilot address the feedback. Make sure that we have requires antiforgery and that we validate the feature manually inside the handler

Copilot · 2026-07-03T17:06:39Z

@copilot address the feedback. Make sure that we have requires antiforgery and that we validate the feature manually inside the handler

Implemented the follow-up so the scaffolded passkey endpoints now both opt into antiforgery validation via [RequireAntiforgeryToken] and explicitly check the middleware’s IAntiforgeryValidationFeature before proceeding. This is covered in commit 485a3f1.

javiercn · 2026-07-03T19:02:56Z

+
+}
+
+public class BlazorWebTemplatePasskeyAntiforgeryTest


This test proves nothing. Remove it.

javiercn

@copilot mostly ok, but the test doesn't prove anything and should be removed. The e2e tests already cover this case.

Copilot · 2026-07-03T19:14:03Z

@copilot mostly ok, but the test doesn't prove anything and should be removed. The e2e tests already cover this case.

Removed the no-op template regression test and kept the implementation change intact; the update is in commit 9964af6.

Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>

Copilot

Pull request overview

Updates the Blazor Web (Individual auth) project template passkey flow to work when the app uses fetch-metadata based CsrfProtection, by removing the legacy antiforgery token/header path and opting the passkey option endpoints into middleware-based CSRF validation.

Changes:

Removed antiforgery token acquisition/plumbing from the PasskeySubmit component and its companion JavaScript so passkey option requests no longer send the legacy requestverificationtoken header.
Updated /Account/PasskeyCreationOptions and /Account/PasskeyRequestOptions template endpoints to opt into antiforgery/CSRF middleware via [RequireAntiforgeryToken] and to surface validation failures as 400 responses.
Minor cleanup in the Blazor template test file (unused using / whitespace).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/Shared/PasskeySubmit.razor.js	Stops sending legacy antiforgery headers when fetching passkey options.
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/Shared/PasskeySubmit.razor	Removes antiforgery token generation/injection from the passkey submit component.
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs	Opts passkey option endpoints into middleware-based CSRF validation and checks the middleware verdict.
src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorWebTemplateTest.cs	Removes an unused using / whitespace-only change.

The scaffolded Blazor template requires all .razor files under Web.ProjectTemplates/content to be UTF-8-BOM-encoded (enforced by ByteOrderMarkTest.RazorFilesInWebProjects_ShouldContainBOM). The rewrite in this PR stripped the BOM; restore it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…-issue

Under the default-on CsrfProtectionMiddleware (with app.UseAntiforgery() removed by #67119), the hidden __RequestVerificationToken fields rendered by <AntiforgeryToken /> are never validated. Blazor SSR form binding and minimal-API [FromForm] parameters auto-attach IAntiforgeryMetadata, so those endpoints stay CSRF-protected by the new middleware. - Remove 12 dead <AntiforgeryToken /> components across 10 razor files. - Add explicit [RequireAntiforgeryToken] to /DownloadPersonalData (JSON minimal-API POST with no [FromForm] auto-attach). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

This endpoint reads no form body ([FromServices] only), so neither FormFeature nor RequestDelegateFactory form binding will reject on a failed IAntiforgeryValidationFeature verdict. Add an explicit check matching the pattern used by the sibling PasskeyCreationOptions and PasskeyRequestOptions endpoints, so cross-site POSTs are rejected with 400 instead of silently returning the user's personal data. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Switch the three explicit-check endpoints (PasskeyCreationOptions, PasskeyRequestOptions, DownloadPersonalData) from `is { IsValid: false }` to `is not { IsValid: true }` so that a null feature (e.g. when CsrfProtectionMiddleware is skipped for any reason) is also rejected. The endpoints explicitly opted in via [RequireAntiforgeryToken], so proceeding without a validated verdict would violate that intent. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The prior commit used `is not { IsValid: true } antiforgeryValidationFeature` which does not definitely-assign the pattern variable in the negated branch. Extract the feature into an explicit local before the check to compile cleanly and keep fail-closed semantics on null / IsValid=false. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…68277) The failures tracked by #66708 were a real regression, not flakiness. They were fixed by #67589 (Fix Blazor passkey registration under CsrfProtection). The test has been green on main ever since. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ff84308e-d869-4c91-aa30-36e2bde27627

Copilot AI assigned Copilot and javiercn Jul 3, 2026

Copilot AI linked an issue Jul 3, 2026 that may be closed by this pull request

Blazor Web App Individual-auth passkey registration fails with antiforgery 500 under the new CsrfProtection middleware #67588

Closed

Copilot started work on behalf of javiercn July 3, 2026 15:47 View session

Copilot AI changed the title ~~[WIP] Fix passkey registration failure with antiforgery in Blazor app~~ Fix Blazor passkey registration under CsrfProtection Jul 3, 2026

Copilot AI requested a review from javiercn July 3, 2026 16:01

Copilot finished work on behalf of javiercn July 3, 2026 16:01

javiercn reviewed Jul 3, 2026

View reviewed changes

Copilot started work on behalf of javiercn July 3, 2026 16:42 View session

Copilot AI requested a review from javiercn July 3, 2026 16:51

Copilot finished work on behalf of javiercn July 3, 2026 16:51

Copilot started work on behalf of javiercn July 3, 2026 16:57 View session

Copilot finished work on behalf of javiercn July 3, 2026 17:07

javiercn reviewed Jul 3, 2026

View reviewed changes

Copilot started work on behalf of javiercn July 3, 2026 19:04 View session

Copilot finished work on behalf of javiercn July 3, 2026 19:14

Copilot AI requested a review from javiercn July 3, 2026 19:14

Copilot AI and others added 4 commits July 6, 2026 08:43

Fix Blazor passkey antiforgery template flow

98c24a0

Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>

Add antiforgery metadata to passkey endpoints

af2b689

Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>

Honor antiforgery validation in passkey endpoints

c577ef7

Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>

Remove redundant passkey antiforgery test

915b123

Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>

javiercn force-pushed the copilot/fix-passkey-registration-antiforgery-issue branch from 9964af6 to 915b123 Compare July 6, 2026 06:43

javiercn marked this pull request as ready for review July 6, 2026 06:43

Copilot AI review requested due to automatic review settings July 6, 2026 06:43

Copilot started reviewing on behalf of javiercn July 6, 2026 06:44 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

DeagleGross mentioned this pull request Jul 6, 2026

Rerun PostRoutingPipeline on Rerouting #67618

Merged

Merge branch 'main' into copilot/fix-passkey-registration-antiforgery…

13efe5b

…-issue

DeagleGross approved these changes Jul 8, 2026

View reviewed changes

DeagleGross and others added 4 commits July 8, 2026 14:33

javiercn approved these changes Jul 10, 2026

View reviewed changes

oroztocil approved these changes Jul 10, 2026

View reviewed changes

DeagleGross merged commit 68dacc0 into main Jul 10, 2026
25 checks passed

DeagleGross deleted the copilot/fix-passkey-registration-antiforgery-issue branch July 10, 2026 11:49

dotnet-maestro Bot mentioned this pull request Jul 12, 2026

[main] Source code updates from dotnet/aspnetcore dotnet/dotnet#7678

Merged

dotnet-milestone-bot Bot added this to the 11.0-preview7 milestone Jul 13, 2026

oroztocil mentioned this pull request Aug 7, 2026

Unquarantine BlazorWebTemplateTest.BlazorWebTemplate_CanUsePasskeys #68277

Merged

danroth27 mentioned this pull request Aug 9, 2026

Update Blazor Identity scaffolder to align with the .NET 11 Blazor Web App template dotnet/Scaffolding#3797

Open

8 tasks

PureWeen mentioned this pull request Aug 18, 2026

Add ASP.NET Core adversarial fix workflows #68625

Closed

4 tasks

Navigation Menu

Uh oh!

Fix Blazor passkey registration under CsrfProtection - #67589

Fix Blazor passkey registration under CsrfProtection#67589
DeagleGross merged 10 commits into
mainfrom
copilot/fix-passkey-registration-antiforgery-issue

Copilot AI commented Jul 3, 2026 •

edited by DeagleGross

Loading

Uh oh!

javiercn left a comment

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

javiercn commented Jul 3, 2026

Uh oh!

javiercn commented Jul 3, 2026

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

javiercn Jul 3, 2026

Uh oh!

javiercn left a comment

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

Copilot AI commented Jul 3, 2026 • edited by DeagleGross Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

javiercn left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

javiercn commented Jul 3, 2026

Uh oh!

javiercn commented Jul 3, 2026

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

javiercn Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

javiercn left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Jul 3, 2026 •

edited by DeagleGross

Loading