Fix browser token auth over HTTP by adamint · Pull Request #16818 · microsoft/aspire

Adam Ratzman (adamint) · 2026-05-06T04:21:23Z

Description

This fixes browser-token dashboard authentication when the dashboard is available over both HTTPS and HTTP. Safari can retain HTTPS localhost cookie state that shadows a later HTTP browser-token sign-in, causing the dashboard to prompt for the token repeatedly even after a successful sign-in.

Changes:

Adds a browser-token cookie manager that uses a separate .Aspire.Dashboard.Auth.Http cookie name for HTTP requests while keeping .Aspire.Dashboard.Auth for HTTPS requests.
Adds mixed HTTPS/HTTP dashboard integration coverage for browser-token sign-in and cookie emission.

Validation:

dotnet test --project tests/Aspire.Dashboard.Tests/Aspire.Dashboard.Tests.csproj --no-launch-profile -- --filter-class "*.FrontendBrowserTokenAuthTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"
dotnet test --project tests/Aspire.Dashboard.Tests/Aspire.Dashboard.Tests.csproj --no-launch-profile -- --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
  - Link to aspire.dev issue:
    - New issue
- No

Use a distinct dashboard auth cookie name for browser-token auth on HTTP endpoints so stale HTTPS cookie state cannot shadow an HTTP sign-in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-06T04:21:39Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16818

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16818"

Run forwarded header normalization before browser-token validation so sign-in cookie naming uses the same scheme as later authorization. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Fixes browser-token dashboard authentication when the dashboard is reachable over both HTTPS and HTTP (notably Safari’s localhost cookie behavior) by separating cookie names per scheme and adding integration coverage for mixed-scheme scenarios.

Changes:

Introduces an ICookieManager implementation that uses a distinct cookie name for HTTP requests while keeping the existing cookie name for HTTPS.
Ensures UseForwardedHeaders() runs before browser-token validation so the normalized scheme influences cookie issuance correctly.
Adds integration tests covering mixed HTTPS/HTTP login flows and cookie emission semantics.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/Aspire.Dashboard.Tests/Integration/FrontendBrowserTokenAuthTests.cs	Adds mixed-scheme integration tests for browser-token redirects and cookie name/`Secure` behavior.
src/Aspire.Dashboard/DashboardWebApplication.cs	Wires the new cookie manager and moves forwarded-headers middleware earlier in the pipeline.
src/Aspire.Dashboard/Authentication/BrowserTokenCookieManager.cs	Adds scheme-dependent cookie naming logic to avoid HTTP/HTTPS cookie collisions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

James Newton-King (JamesNK) · 2026-05-06T05:49:47Z

                        return Task.CompletedTask;
                    };
                    options.Cookie.Name = DashboardAuthCookieName;
+                    options.CookieManager = new BrowserTokenCookieManager(DashboardHttpAuthCookieName);


What about OAuth? Should it set this? If so, rename to AspireDashboardCookieManager

Applied to OpenID Connect as well in #17368: the manager is now AspireDashboardCookieManager, and both OIDC and browser-token auth use it.

James Newton-King (JamesNK) · 2026-05-06T05:50:43Z

+        Assert.Contains(deletedCookies, c => c.StartsWith(".Aspire.Dashboard.Auth=", StringComparison.Ordinal) && c.Contains("expires=Thu, 01 Jan 1970", StringComparison.OrdinalIgnoreCase));
+        Assert.Contains(deletedCookies, c => c.StartsWith(".Aspire.Dashboard.Auth.Http=", StringComparison.Ordinal) && c.Contains("expires=Thu, 01 Jan 1970", StringComparison.OrdinalIgnoreCase));


Assert.Collection here to be explicit?

Changed to Assert.Collection in #17368 so the two expected deleted cookies are asserted explicitly.

James Newton-King (JamesNK) · 2026-05-06T05:53:05Z

This change is too risky for 13.3. Soonest it should go in is 13.4.

David Fowler (davidfowl) · 2026-05-06T06:00:07Z

This isn't a regression right?

James Newton-King (JamesNK) · 2026-05-06T06:03:32Z

I don't think so. Nothing has changed here.

Adam Ratzman (adamint) · 2026-05-06T15:24:26Z

Marking as draft, since the issue was pushed back to 13.4

Fix browser token auth over HTTP

4aabc2e

Use a distinct dashboard auth cookie name for browser-token auth on HTTP endpoints so stale HTTPS cookie state cannot shadow an HTTP sign-in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Handle forwarded scheme before browser token auth

fbe0ae7

Run forwarded header normalization before browser-token validation so sign-in cookie naming uses the same scheme as later authorization. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Adam Ratzman (adamint) marked this pull request as ready for review May 6, 2026 04:44

Copilot AI review requested due to automatic review settings May 6, 2026 04:44

Adam Ratzman (adamint) requested a review from James Newton-King (JamesNK) as a code owner May 6, 2026 04:44

Copilot started reviewing on behalf of Adam Ratzman (adamint) May 6, 2026 04:44 View session

Adam Ratzman (adamint) marked this pull request as draft May 6, 2026 04:46

Copilot AI reviewed May 6, 2026

View reviewed changes

Comment thread src/Aspire.Dashboard/Authentication/BrowserTokenCookieManager.cs

Add WebKit browser token regression test

e021fbf

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Adam Ratzman (adamint) marked this pull request as ready for review May 6, 2026 05:25

Clear HTTP browser token cookie on HTTPS sign-out

ab67422

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

James Newton-King (JamesNK) reviewed May 6, 2026

View reviewed changes

Adam Ratzman (adamint) marked this pull request as draft May 6, 2026 15:25

github-actions Bot mentioned this pull request May 6, 2026

[repo-pulse] 📊 Repo Pulse — Daily Activity Dashboard #16404

Open

Ankit Jain (radical) mentioned this pull request May 7, 2026

[preview] repo-pulse + commit-digest mock — 2026-05-03 → 2026-05-06 radical/aspire#51

Open

Adam Ratzman (adamint) closed this May 18, 2026

microsoft-github-policy-service Bot added this to the 13.4 milestone May 18, 2026

Adam Ratzman (adamint) mentioned this pull request May 21, 2026

Fix browser token auth over HTTP #17368

Merged

14 tasks

github-actions Bot locked and limited conversation to collaborators Jun 21, 2026

Navigation Menu

Uh oh!

Fix browser token auth over HTTP - #16818

Fix browser token auth over HTTP#16818
Adam Ratzman (adamint) wants to merge 4 commits into
microsoft:mainfrom
adamint:fix/issue16067-browser-token-http

Adam Ratzman (adamint) commented May 6, 2026

Uh oh!

github-actions Bot commented May 6, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

James Newton-King (JamesNK) May 6, 2026

Uh oh!

Adam Ratzman (adamint) May 21, 2026

Uh oh!

James Newton-King (JamesNK) May 6, 2026

Uh oh!

Adam Ratzman (adamint) May 21, 2026

Uh oh!

Uh oh!

James Newton-King (JamesNK) commented May 6, 2026

Uh oh!

David Fowler (davidfowl) commented May 6, 2026

Uh oh!

James Newton-King (JamesNK) commented May 6, 2026

Uh oh!

Adam Ratzman (adamint) commented May 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		Assert.Contains(deletedCookies, c => c.StartsWith(".Aspire.Dashboard.Auth=", StringComparison.Ordinal) && c.Contains("expires=Thu, 01 Jan 1970", StringComparison.OrdinalIgnoreCase));
		Assert.Contains(deletedCookies, c => c.StartsWith(".Aspire.Dashboard.Auth.Http=", StringComparison.Ordinal) && c.Contains("expires=Thu, 01 Jan 1970", StringComparison.OrdinalIgnoreCase));

Uh oh!

Conversation

Adam Ratzman (adamint) commented May 6, 2026

Description

Checklist

Uh oh!

github-actions Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

James Newton-King (JamesNK) May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Adam Ratzman (adamint) May 21, 2026

Choose a reason for hiding this comment

Uh oh!

James Newton-King (JamesNK) May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Adam Ratzman (adamint) May 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

James Newton-King (JamesNK) commented May 6, 2026

Uh oh!

David Fowler (davidfowl) commented May 6, 2026

Uh oh!

James Newton-King (JamesNK) commented May 6, 2026

Uh oh!

Adam Ratzman (adamint) commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented May 6, 2026 •

edited

Loading

Adam Ratzman (adamint) commented May 6, 2026 •

edited

Loading