Align passkey guidance with the .NET 11 Blazor template - #37559
Open
rolandVi wants to merge 1 commit into
Open
Conversation
guardrex
self-requested a review
August 31, 2026 15:58
Collaborator
|
Thanks, @rolandVi ... Let me try and get back to you tomorrow (Tuesday). I'm ⛏️😅 at the moment on a doc overhaul. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents dotnet/aspnetcore#65343, dotnet/aspnetcore#65752, dotnet/aspnetcore#67539 and dotnet/aspnetcore#67589.
The passkey articles had drifted from the Blazor Web App template, so a .NET 11 reader following them copies the .NET 10 flow.
Versioned JavaScript
The .NET 10 samples stay as they are. The .NET 11 versions drop the
headersargument, which the template stopped sending in dotnet/aspnetcore#67589 when it moved to the fetch-metadata CSRF middleware. Those endpoints are still validated, just by the middleware instead of a token header, so nothing loses protection here.The rest
RedirectToInvalidUsersnippet doesn't compile any more, because Update Blazor templates to use TempData aspnetcore#65752 removedRedirectToWithStatusfrom the template. .NET 10 already ships the method, so the section was wrong in both versions. Dropped it.PasskeyAuthenticators.csto the model classes list, missing since Infer passkey display name from AAGUID aspnetcore#65343.PasskeySignInAsyncreturnsSignInResult.Failedon expired session state instead of throwing, per SignInManager: return SignInResult.Failed for expired passkey session challenge aspnetcore#67539.Two things I left out on purpose: the creation options URL moving to
/Account/Manage/, andPasskeyOperationgainingReauthenticate. Both are .NET 12 only, and there's noaspnetcore-12.0moniker yet, so gated content would render for nobody.One fix outside the drift: the "locate the Blazor script tag" snippet was missing
@Assets[...], which is wrong in every version.Checked every sample against
release/10.0,release/11.0andmain.Internal previews
Build report