Blazor Server Authentication Loop (Cookie issue) behind FortiWeb (SSL Offloading)

Question

Hi everyone,I'm facing a persistent login loop with a Blazor Server (.NET Core) application hosted on IIS 10, sitting behind a FortiWeb appliance. The setup: External Traffic: HTTPS (SSL handled by FortiWeb).Internal Traffic: HTTP (between FortiWeb and IIS).Server Side: I have configured IIS URL Rewrite to force HTTPS=on server variable and enabled X-Forwarded-Proto support. The Problem:When users try to log in, the authentication cookie (.AspNetCore.Cookies or .AspNetCore.Identity.Application) is never stored in the browser, although other cookies like .AspNetCore.Session and FortiWeb's persistence cookies are present. This causes an infinite redirect loop back to the login page.Locally (bypassing FortiWeb), the application works perfectly and the authentication cookie is generated correctly. What I've tried so far: Enabled "Add X-Forwarded-Proto" and "Add X-Forwarded-For" in the FortiWeb X-Forwarded-For Rule.Verified that "Cookie Security" is disabled in the Web Protection Profile to avoid interference.Configured IIS to treat the connection as secure via URL Rewrite rules.Checked that WebSockets (required for Blazor) are supposedly passing through, but the session never establishes because the Auth Cookie is missing. Questions: Is there a specific setting in the Web Protection Profile that might be stripping .AspNetCore.* cookies even if Cookie Security is off?Does FortiWeb require specific Rewriting Rules to handle the SameSite=Lax or Secure attributes that .NET Core Identity adds to cookies when it thinks it's on HTTPS?Are there any known issues with SignalR/WebSockets persistence that could be causing the server to drop the authentication challenge? Any guidance on the FortiWeb configuration (Server Policy or Protection Profile) would be greatly appreciated.

Jean-Philippe_P · Accepted Answer

Hello again ecardona,

I found this solution, can you tell us if it helps, please?

Troubleshooting Steps for Blazor Server Authentication Loop

Based on your description, it seems like the issue might be related to how FortiWeb is handling cookies, particularly the .AspNetCore.Cookies or .AspNetCore.Identity.Application cookies. Here are some steps and considerations to help troubleshoot and potentially resolve the issue:

1. Check Internal Cookie Settings

Internal Cookie Secure Flag: Ensure that the secure flag for internal cookies is enabled only if the connection is over SSL. Since your internal traffic is HTTP, this might not be applicable, but it's worth checking if any settings are inadvertently affecting cookie handling.
Internal Cookie SameSite Flag: Verify if the internal-cookie-samesite setting is enabled and set to the appropriate value (strict, lax, or none). This setting can affect how cookies are sent in cross-origin requests.

2. Web Protection Profile Settings

Cookie Security: Although you mentioned that cookie security is disabled, double-check the web protection profile to ensure no other settings might be interfering with cookie handling.
Monitor Mode: Consider enabling monitor-mode temporarily to log attacks without performing deny or redirect actions. This can help identify if any rules are inadvertently affecting the authentication process.

3. Rewriting Rules and Headers

X-Forwarded-Proto: Ensure that the X-Forwarded-Proto header is correctly set to https by FortiWeb. This is crucial for IIS to recognize the connection as secure.
URL Rewrite Rules: Double-check your IIS URL rewrite rules to ensure they are correctly configured to handle the X-Forwarded-Proto header and force HTTPS.

4. WebSockets and SignalR

WebSockets Support: Confirm that WebSockets are fully supported and not being blocked by any FortiWeb settings. This is essential for Blazor Server applications.
Session Persistence: Verify that session persistence settings in FortiWeb are correctly configured to maintain the session state required for SignalR connections.

Follow-Up Questions and Clarifications

Have you checked the FortiWeb logs for any entries related to cookie handling or blocked requests? This can provide insights into whether FortiWeb is interfering with the cookies.
Are there any specific FortiWeb rules or policies that might be affecting the .AspNetCore.* cookies? Reviewing these settings might help identify potential issues.
Have you tested with different browsers to see if the issue persists across all of them? Sometimes, browser-specific settings or behaviors can affect cookie handling.
Is there any custom configuration in FortiWeb that might be affecting the handling of secure or SameSite cookie attributes? Understanding these configurations can help pinpoint the issue.

If these steps do not resolve the issue, further investigation into FortiWeb's configuration and logs might be necessary.

Jean-Philippe_P · Answer

Hello ecardona,    Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Sign up

Login with SSO

Login to the community

Login with SSO