Aspnetcore: MSAL login modes options: redirect / pop-up

[MortenMeisler]

Is there any way right now or could there be options to make it easy to choose redirect login-mode instead of pop-up which seems to be default right now (and have the danger of being blocked)

Inspiration: https://github.com/cradle77/Blazor.Msal/blob/master/src/Des.Blazor.Authorization.Msal/LoginModes.cs

Replicate: Create a new blazor wasm app with authentication: dotnet new blazorwasm -au SingleOrg

Using Microsoft.Authentication.WebAssembly.Msal Version="3.2.0-preview3.20168.3"

Reference to put in backlog:

19966

[javiercn]

@MortenMeisler thanks for contacting us.

We do pop-up by default and fallback to a redirect flow. This is not a behavior we plan to change at the moment, but we'll take it into consideration if we hear more feedback about it.

[JakobGSvendsen]

Hello. As I understand from this, it is not possible to select redirect as login option.

I would suggest you add possibility to select redirect. I am suprised that popup is selected as default.

by my experience running multi tenant cloud apps for the last 5 years is that popup will provide all sorts of issues with blowser blockers and other stuff that regular users has issues with, then turning into more supprot calls and wasted work hours.

We use MSAL in angular and there it is easy to set

msalCfg.popUp = false

Not having the option to use redirect, is a showstopper for most of the projects we deliver to our enterprise customers.

[MortenMeisler]

I changed title to clarify that it's not that I necessarily object against pop-up is the default. But it should at least be optional if this is default behavior.

Thanks for all the hard work and a great framework :)

[chrissainty]

I would agree with the comments here, we should have the option to do redirect, I've already hit an issue with popup blockers. Even Edge will block the login popup by default and it must be allowed.

[javiercn]

@chrissainty if the popup is blocked we will try the redirect automatically. Isn't that enough?

[chrissainty]

@javiercn Fair point and you're probably right.

I guess being nitpicky but seeing a blocked popup message may concern some people, wondering what was blocked and was it something malicious.

I also think some people may have a preference that they just don't want to use a popup, even if it's an option. Popups can feel a bit dated in the modern web apps and I think they do have a bit of stigma due to being used for ads and such.

I'm not saying this is a crushing priority but surfacing this as a configuration option when adding the MsalAuthentication services seems like a relatively easy win.

[javiercn]

@chrissainty the technical aspect of it is easy (surfacing an option), but with every change there is testing and experience to be validated and a cost of updating our automation/manual test instructions, which ends up adding to the cost.

If we see more people ask for this, that can change the needle, but every feature we decide to do, usually means there's something else that doesn't fit in the schedule, so it is also a matter of priorities.

I hope this helps in understanding a bit the kind of reasoning we follow behind these things and puts things a bit in perspective. We want to be as transparent as possible in our decissions.

[chrissainty]

@javiercn I completely get it and I appreciate you taking the time to explain.

[JakobGSvendsen]

I get that you are busy and have a tight schedule. It just don't change that msal for angular is unusable in a professional setting imo. This is a pretty tough showstopper.
Expecting warnings is not acceptable for any of my customers.
We will have to make our own auth library to deliver a professional enterprise app. (Or maybe we can extend this library).
I have shared this on Twitter in hopes of that more people will bring their opinion and then we will see who people agree with.

Usually I say that you shouldn't promise to make anything if you don't have time to do it properly. Don't promise a dinner and serve white toastbread as main course. ;-) in this case you are promising msal for blazor but removed key features that blocks use of it.

Anyways I think it's great that you are transparent and I like that we can discuss here (no hard feelings ;))

[aledevbr]

I got here exactly looking for a solution for the popup login, and as I see in this conversation, other people also need it as a redirect, the popup has many problems with our users and customers as well.
I'm currently trying to make a change to the MSAL code to force the use by redirection, avoiding the popup, I do this in the hope of leaving a version with the configurable login option. I would be happy if that happens until November, where we will have a lot of new things too.
So, I am one more vote for this implementation, which is very important for us and can become a real block if it is not implemented.
I thank you for the excellent services you are doing, the tool is fantastic.

[andrevlins]

Hello. As I understand from this, it is not possible to select redirect as login option.

I would suggest you add possibility to select redirect. I am suprised that popup is selected as default.

by my experience running multi tenant cloud apps for the last 5 years is that popup will provide all sorts of issues with blowser blockers and other stuff that regular users has issues with, then turning into more supprot calls and wasted work hours.

We use MSAL in angular and there it is easy to set

msalCfg.popUp = false

Not having the option to use redirect, is a showstopper for most of the projects we deliver to our enterprise customers.

For me it is also an obstacle for our customers. I would very much like it to be an option.

Thank you for the excellent work!

[stewartbright]

I just came across this as well, and I was really surprised to find out pop-up was the only option. There are numerous reasons, not the least of which being user experience, to suppress pop-ups and use the redirect approach.

[morganc9]

Hello,
I need the same thing, redirect instead of pop-up for my customers
@guardrex I thnik it's the same as #18269... A lot of people come to the same conclusion :) we need redirect. All the hopes are on you ;)

[pheuter]

This functionality would be helpful for me too for the following reason: I have noticed that when a pop-up successfully opens but the user initiates a different User Flow inside it, such as clicking on "Forgot Password", the popup redirects back into the app with an error which in turn causes a redirect attempt. I would like to prevent the popup -> redirect fallback in the first place to streamline the user experience so that they don't have to select "Forgot Password" twice, once in the popup and then again during the redirect.

[chrissainty]

In order to tackle this I created a modified version of the AuthenticationService which uses redirect instead of the popup > fail > redirect method. I'll happily make this available as a NuGet package if it would be useful to everyone until the team get a chance to look at this issue?

It's literally a drop in replacement for the current one so it only involves installing the package and updating the reference to the JS file in the host page.

[javiercn]

@chrissainty if you want to contribute the feature we would be happy to accept a PR.

The way I see this working would be as a parameter that is added to the provider options an that you pass down to the library to decide the authentication mode that you want.

[chrissainty]

@javiercn I'm happy to have a go at this one. I'll take a look over the weekend.

[MortenMeisler]

@chrissainty if you want to contribute the feature we would be happy to accept a PR.

The way I see this working would be as a parameter that is added to the provider options an that you pass down to the library to decide the authentication mode that you want.

Agree. Just leave the default as it is imo (also to avoid breaking changes)

Then a enumeration parameter of Redirect and Popup LoginMode=LoginModes.Redirect which is Redirect with fallback to popup and vice versa

[chrissainty]

@javiercn I've raised an inital PR with the changes. I didn't see any testing for that service, so I haven't added any but if there are some please let me know where and I'll add any required tests.

[javiercn]

This is now merged into master!

[javiercn]

Thanks again @chrissainty for the contribution!

[MortenMeisler]

great work! Thanks @chrissainty and @javiercn. Sorry for being slow on the "system" here... but does merge to master mean .NET 5.. aka the change will be released in Preview 7?

[javiercn]

@MortenMeisler not sure if preview7 or preview8. but it does mean 5.0

[MortenMeisler]

Ok cool thanks :)