Configure Auth

From the author

Add authentication and authorization to a Blazor Web App, accounting for the app's render mode. USE WHEN the user needs [Authorize] on pages, AuthorizeView, role or policy-based access, login/logout Identity pages, or AuthenticationStateProvider. Also USE WHEN auth state is null after WebAssembly loads, SignInManager throws in an interactive component, NotAuthorized content never renders in static SSR, or HttpContext.User is null in an interactive component. DO NOT USE for general component authoring (see author-component), for prerendering concerns unrelated to auth (see support-prerendering), or for managing non-auth cascading state (see coordinate-components).

— the description by .NET (Microsoft)

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured approach to configuring authentication and authorization in Blazor Web Apps. It addresses the complexities of managing identity across static server-side rendering (SSR), interactive server, and WebAssembly render modes. The guide covers service registration, configuring App.razor for correct render mode handling, protecting pages and components, and ensuring auth state persists correctly when switching between server and client-side execution.

What it does

Registers essential authentication and identity services in Program.cs.
Configures App.razor to handle render modes and interactive routing for auth-protected pages.
Implements AuthorizeRouteView and AuthorizeView for page and UI-level access control.
Provides patterns for accessing authentication state via cascading parameters.
Ensures compatibility for Identity pages by enforcing static SSR via ExcludeFromInteractiveRouting.
Enables auth state serialization for WebAssembly and Auto render modes.

When to use it

When adding authentication and authorization to a new or existing Blazor Web App.
When encountering issues with null auth state after WebAssembly loads.
When SignInManager throws exceptions in interactive components.
When NotAuthorized content fails to render in static SSR.
When HttpContext.User is null or unavailable in interactive components.

Advantages

Ensures consistent authentication behavior across different Blazor render modes.
Prevents common runtime exceptions related to HttpContext and SignInManager in interactive circuits.
Provides clear patterns for role and policy-based access control.
Correctly handles the transition between server-side prerendering and client-side execution.

Usage examples

“How do I secure a page in my Blazor Web App so only admins can see it?”: The agent will guide you to add the @attribute [Authorize(Roles = "Admin")] directive to the top of your Razor page.
“My login page crashes when I use global interactivity. How do I fix it?”: The agent will instruct you to mark the login page with [ExcludeFromInteractiveRouting] and update App.razor to use AcceptsInteractiveRouting() to ensure it renders statically.
“Why is my user showing as anonymous after the WebAssembly app loads?”: The agent will explain the need for AddAuthenticationStateSerialization on the server and AddAuthenticationStateDeserialization on the client to pass auth state across the boundary.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/dotnet/configure-auth/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip configure-auth.zip -d .agents/skills

Documentation by .NET (Microsoft)

Step 1 — Read AGENTS.md

Read AGENTS.md at the workspace root for the project's interactivity mode and scope before making changes.

Step 2 — Register auth services in Program.cs

// Program.cs (server project)
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddAuthorization();

For ASP.NET Core Identity add the Identity services:

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = IdentityConstants.ApplicationScheme;
    options.DefaultSignInScheme = IdentityConstants.ExternalScheme;
})
.AddIdentityCookies();

builder.Services.AddIdentityCore<ApplicationUser>()
    .AddRoles<IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddSignInManager()
    .AddDefaultTokenProviders();

Step 3 — Wire App.razor for auth and render mode

The App.razor component must use AuthorizeRouteView and conditionally apply the render mode so that pages excluded from interactive routing render statically.

<!DOCTYPE html>
<html>
<head>
    <HeadOutlet @rendermode="RenderModeForPage" />
</head>
<body>
    <Routes @rendermode="RenderModeForPage" />
    <script src="_framework/blazor.web.js"></script>
</body>
</html>

@code {
    [CascadingParameter]
    public HttpContext HttpContext { get; set; } = default!;

    private IComponentRenderMode? RenderModeForPage =>
        HttpContext.AcceptsInteractiveRouting()
            ? InteractiveServer   // replace with the app's render mode
            : null;
}

In Routes.razor (or wherever the router lives), use AuthorizeRouteView:

<Router AppAssembly="typeof(Program).Assembly">
    <Found Context="routeData">
        <AuthorizeRouteView RouteData="routeData"
                            DefaultLayout="typeof(Layout.MainLayout)">
            <NotAuthorized>
                @if (context.User.Identity?.IsAuthenticated != true)
                {
                    <RedirectToLogin />
                }
                else
                {
                    <p>You are not authorized to access this resource.</p>
                }
            </NotAuthorized>
        </AuthorizeRouteView>
        <FocusOnNavigate RouteData="routeData" Selector="h1" />
    </Found>
</Router>

Step 4 — Protect pages and components

[Authorize] attribute on pages

@page "/admin"
@attribute [Authorize]

With roles or policies:

@attribute [Authorize(Roles = "Admin")]
@attribute [Authorize(Policy = "RequireManager")]

AuthorizeView for conditional UI

<AuthorizeView>
    <Authorized>Welcome, @context.User.Identity?.Name!</Authorized>
    <NotAuthorized><a href="Account/Login">Log in</a></NotAuthorized>
</AuthorizeView>

Role/policy variants:

<AuthorizeView Roles="Admin,Manager">
    <Authorized>Admin content here</Authorized>
</AuthorizeView>

Access auth state in code

[CascadingParameter]
private Task<AuthenticationState>? AuthState { get; set; }

protected override async Task OnInitializedAsync()
{
    if (AuthState is not null)
    {
        var state = await AuthState;
        var isAdmin = state.User.IsInRole("Admin");
    }
}

Step 5 — Identity pages must stay static SSR

SignInManager and UserManager use HttpContext internally and throw in interactive components. Identity pages (login, register, manage) must render as static SSR.

In a globally interactive app, mark every Identity page:

@page "/Account/Login"
@attribute [ExcludeFromInteractiveRouting]

This forces a full-page navigation (exits the interactive circuit) so the page renders through the static SSR pipeline with a real HttpContext.

App.razor must use AcceptsInteractiveRouting() (Step 3) to return null for these pages — otherwise the framework still tries to render them interactively.

In a per-page app, Identity pages are static by default (no @rendermode directive), so [ExcludeFromInteractiveRouting] is not needed.

Step 6 — Auth state in WebAssembly / Auto mode

WebAssembly components run in the browser and have no HttpContext. Auth state must be serialized from the server during prerendering and deserialized on the client.

Server Program.cs:

builder.Services.AddAuthenticationStateSerialization();

Client .Client/Program.cs:

builder.Services.AddAuthenticationStateDeserialization();

Without these calls, Task<AuthenticationState> resolves to an anonymous user after WebAssembly takes over from prerendering.

AddAuthenticationStateSerialization accepts options to include role and claim data:

builder.Services.AddAuthenticationStateSerialization(options =>
    options.SerializeAllClaims = true);

Render Mode × Auth Matrix

Render mode	HttpContext.User	SignInManager	Auth state source	Key requirement
Static SSR	Available	Works	Server pipeline	Use middleware for redirects, `<NotAuthorized>` does NOT render
Server (interactive)	NOT available	Throws	`CascadingAuthenticationState`	Use `[Authorize]` + `AuthorizeView`, not `HttpContext`
WebAssembly	NOT available	Throws	Serialized from server	`AddAuthenticationStateSerialization` / `Deserialization`
Auto	NOT available after WASM	Throws	Serialized from server	Same as WebAssembly; register in both Program.cs files

Common Mistakes

Mistake	Symptom	Fix
Using `HttpContext.User` in interactive component	Null or stale claims	Use `[CascadingParameter] Task<AuthenticationState>`
`SignInManager` in interactive component	`InvalidOperationException`	Move to static SSR page with `[ExcludeFromInteractiveRouting]`
Missing `AddAuthenticationStateSerialization`	Anonymous user after WASM loads	Add to server Program.cs; add `Deserialization` to client Program.cs
`<NotAuthorized>` in static SSR layout	Content never shown	Static SSR uses middleware pipeline; redirect via `LoginPath` or `RedirectToLogin` component
Global interactivity without `AcceptsInteractiveRouting`	Identity pages crash	Add `AcceptsInteractiveRouting()` check in App.razor (Step 3)
Missing `AddCascadingAuthenticationState()`	`Task<AuthenticationState>` is null	Register in Program.cs (Step 2)

Files

ATTRIBUTION.mdAdded by AutoGineer841 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md7.0 KiB

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Implement Spec
Matt Pocock· Community
A workflow for implementing technical specifications and tickets using concurrent subagents.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository317.5k
MCP Builder
AnthropicOfficial
A comprehensive guide for building high-quality Model Context Protocol (MCP) servers to integrate external services with LLMs.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
Apache-2.0Low riskHas scriptsGitHub stars of the source repository188.6k
Schema
Corey Haines· Community
Expert guidance for implementing and optimizing JSON-LD schema markup to improve search engine content understanding.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository59k
Postgresql Table Design
Seth Hobson· Community
A comprehensive guide for designing, reviewing, and optimizing PostgreSQL database schemas.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository42.3k
SQL Optimization Patterns
Seth Hobson· Community
A comprehensive guide to optimizing SQL database performance through indexing, query plan analysis, and efficient coding patterns.
Software developmentClaude CodeClaude appsOpenAI Codex+14 more
MITGitHub stars of the source repository42.3k
API Scaffolding Fastapi Pro
Seth Hobson· Community
An expert FastAPI developer focused on high-performance, async-first API architecture and production-ready microservices.
Software developmentClaude Code
MITGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download configure-auth.zip