Add .NET 10 MauiBlazorWebIdentity sample by mattleibow · Pull Request #647 · dotnet/blazor-samples

mattleibow · 2026-02-12T18:34:15Z

Overview

This PR adds a new 10.0/MauiBlazorWebIdentity sample — a .NET MAUI Blazor Hybrid app with a companion ASP.NET Core Blazor Web server that shares UI and uses ASP.NET Core Identity for authentication. The sample demonstrates how a native MAUI app can authenticate against the same identity system as the web app, sharing Razor components across both hosts.

What the sample demonstrates

Shared Blazor UI — MauiBlazorWeb.Shared contains pages (Home, Counter, Weather, NotFound) and services consumed by both the MAUI native app and the ASP.NET Core web app.
MAUI client authentication — The native app authenticates via the /identity/ API endpoints (AddIdentityApiEndpoints) using bearer tokens, with MauiAuthenticationStateProvider, TokenStorage, and HttpClientHelper managing the auth flow.
Web server authentication — The web app uses ASP.NET Core Identity with Blazor Server interactive rendering, full identity UI (login, register, 2FA, account management), and cookie-based auth.
Cross-platform database — SQL Server on Windows, SQLite on macOS/Linux, selected automatically via MSBuild OS detection (USE_SQL_SERVER conditional compilation).
Auto-migration — The database is automatically created and migrated at dev startup.

What's new in .NET 10

This sample was created by copying the existing 9.0/MauiBlazorWebIdentity sample and upgrading it with all .NET 10 Blazor template features:

Passkey support (Identity Schema v3)

New AspNetUserPasskeys table via IdentitySchemaVersions.Version3
PasskeySubmit.razor / PasskeySubmit.razor.js shared component for WebAuthn credential creation/assertion
Passkeys.razor — manage page to list/delete passkeys
RenamePasskey.razor — manage page to rename a passkey
PasskeyInputModel.cs / PasskeyOperation.cs — supporting models
Login.razor updated with passkey sign-in option
IdentityComponentsEndpointRouteBuilderExtensions.cs updated with passkey assertion/attestation endpoints

NotFound page

NotFound.razor in the Shared project (available to both MAUI and Web)
UseStatusCodePagesWithReExecute("/not-found") in Program.cs
NotFoundPage parameter on <Router> in both Web and MAUI Routes.razor

ReconnectModal component

ReconnectModal.razor / .razor.css / .razor.js — replaces the old components-reconnect-modal div with a proper Blazor component

App.razor modernization

<ResourcePreloader /> for optimized static asset loading
<ImportMap /> for ES module import maps
@Assets["..."] fingerprinted asset references for cache busting
<ReconnectModal /> component reference

Identity page updates

All 27 identity pages (11 account + 12 manage + 4 shared) replaced with official .NET 10 template versions
IdentityUserAccessor removed — replaced by UserManager<ApplicationUser> with RedirectToInvalidUser() pattern
IdentityRedirectManager updated with new redirect helpers
IdentityRevalidatingAuthenticationStateProvider updated
Input = new() → Input = default! with Input ??= new() pattern
EditContext model binding improvements

Other .NET 10 updates

All TFMs updated to net10.0 / net10.0-*
All NuGet packages updated to 10.0.2
Bootstrap moved from wwwroot/bootstrap/ to wwwroot/lib/bootstrap/dist/ (full dist from template)
app.css updated with .form-floating > .form-control:not(:placeholder-shown) styles
MainLayout.razor.css — added color-scheme: light only;
NavMenu.razor.css — height → min-height
BlazorDisableThrowNavigationException property in Web csproj
Tizen platform target removed
RedirectToLogin component used in Web Routes.razor (MAUI keeps <Login />)
File-scoped namespaces for ApplicationDbContext and ApplicationUser

Architecture decisions

Decision	Rationale
Keep `AddIdentityApiEndpoints` (not template's `AddIdentityCore`)	MAUI client requires `/identity/` REST endpoints for bearer token auth
Do NOT call `AddIdentityCookies()` alongside `AddIdentityApiEndpoints`	`AddIdentityApiEndpoints` registers cookie schemes internally; calling both causes duplicate scheme error
Cross-platform DB via `$([MSBuild]::IsOSPlatform('windows'))`	SQL Server Express doesn't run on macOS; SQLite is the default, SqlServer opt-in on Windows
Ship SQLite migrations only	Generated on macOS; SqlServer users regenerate with `dotnet ef migrations add` + `/p:UseSqlServer=true`
Separate layouts for Web and MAUI	Web has auth-gated NavMenu; MAUI has Login/Logout pages — cannot share layout
`NotFound.razor` in Shared project	Available to both hosts; no `@layout` directive (inherits from router)

Preserved from 9.0 (unchanged)

All MAUI client auth infrastructure (MauiAuthenticationStateProvider, TokenStorage, HttpClientHelper, LoginStatus)
MAUI Login/Logout pages and NavMenu
Web NavMenu (custom auth-gated navigation)
Weather API endpoint with RequireAuthorization()
OpenAPI support
AddAdditionalAssemblies for shared component discovery
Auto-migration at dev startup

Project structure

10.0/MauiBlazorWebIdentity/
└── MauiBlazorWeb/
    ├── MauiBlazorWeb.Shared/     # Shared pages, services, CSS, bootstrap
    ├── MauiBlazorWeb.Web/        # ASP.NET Core Blazor Server + Identity
    └── MauiBlazorWeb/            # .NET MAUI Blazor Hybrid client

Testing

✅ Web project builds successfully on macOS
✅ Web app starts and serves HTTP 200
✅ SQLite database auto-created with all 8 Identity v3 tables (including AspNetUserPasskeys)
✅ Migrations apply cleanly at startup

@assets

Copied 9.0/MauiBlazorWebIdentity and upgraded to .NET 10 with: - All TFMs and packages updated to net10.0/10.0.2 - Identity Schema v3 with passkey support (PasskeySubmit, Passkeys, RenamePasskey) - NotFound page with UseStatusCodePagesWithReExecute - ReconnectModal component - All identity pages updated from official .NET 10 template - Cross-platform DB: SQL Server on Windows, SQLite on macOS/Linux - Bootstrap updated to lib/bootstrap/dist/ (full dist from template) - App.razor: ResourcePreloader, ImportMap, @assets refs - Removed IdentityUserAccessor (replaced by RedirectToInvalidUser) - Removed Tizen platform target - Preserved all MAUI client auth behavior unchanged

- Solution: MauiBlazorWebIdentity.sln (was MauiBlazorWeb.sln) - Shared: MauiBlazorWebIdentity.Shared (was MauiBlazorWeb.Shared) - Web: MauiBlazorWebIdentity.Web (was MauiBlazorWeb.Web) - MAUI: MauiBlazorWebIdentity (was MauiBlazorWeb) - Removed unnecessary nested MauiBlazorWeb/ subfolder - All namespaces updated to match - Differentiates from the non-identity 9.0/MauiBlazorWeb sample

… versions - AddMauiBlazorWebView() was incorrectly renamed during global namespace replace - MAUI packages updated to 10.0.10 (actual available version) - Microsoft.Extensions.Logging.Debug set to 10.0.0

- Add missing 'nav' CSS class to <nav> element in both Web and MAUI NavMenu.razor - Update MAUI MainLayout.razor.css: add 'color-scheme: light only;' - Update MAUI NavMenu.razor.css: height -> min-height

Remove conditional SQL Server/SQLite logic — this is a sample app, no need for cross-platform DB complexity. SQLite works everywhere.

AddIdentityApiEndpoints sets DefaultScheme to BearerAndApplicationScheme (composite scheme for both bearer tokens and cookies). Setting DefaultScheme to ApplicationScheme overrides this and breaks API auth for MAUI clients. Instead, only override DefaultChallengeScheme to ApplicationScheme (cookie), which redirects to /Account/Login on auth challenge while preserving the composite scheme for authentication. This matches the documented pattern from MS Learn for MAUI Blazor Hybrid + Identity apps.

@layout

- Move NotFound.razor from Shared to Web project with @layout MainLayout so UseStatusCodePagesWithReExecute renders it with the sidebar/nav - Create MAUI-specific NotFound.razor with @layout MainLayout since Router's NotFoundPage renders outside <Found> (no DefaultLayout) - Update both Routes.razor to reference their local NotFound pages - Remove Shared NotFound.razor to avoid ambiguous route matching

- Style MAUI Login.razor to match web login (form-floating, btn-lg) - Add Remember Me checkbox with conditional token persistence - Add keychain-access-groups entitlement for Mac Catalyst SecureStorage - Extract TokenStorage.DeserializeToken for memory-only token path

guardrex · 2026-03-05T15:29:13Z

@BethMassi @mattleibow ... Where are we on this one (and the other one here)? We're still lacking this sample for 10.0, so I'm anxious to get it wrapped up and merged.

Make safe area CSS rules universal instead of iOS-only (@supports -webkit-touch-callout). This enables proper safe area handling on Android 15+ (API 35+) which enforces edge-to-edge rendering, causing the app content to render behind the status bar. Changes: - Remove @supports (-webkit-touch-callout: none) wrapper so safe area rules apply to both Android and iOS - Change status bar background from #f7f7f7 to rgb(3, 23, 62) to match the sidebar navbar color (gradient start rgb(5,39,103) composited with the top-row overlay rgba(0,0,0,0.4)) - Apply env(safe-area-inset-left) universally for landscape orientation sidebar padding on both platforms See: dotnet/maui#34462 Co-authored-by: Copilot <[email protected]>

mattleibow · 2026-03-12T19:44:28Z

@guardrex sorry for the delay in getting back to you. I was just doing some more testing and this is ready to go. I just fixed some CSS since last time. It should be an almost identical copy of the .NET 9 sample, but with some new .NET 10 features.

guardrex · 2026-03-12T19:57:19Z

Awesome! Thanks!

@halter73 ... Do you want to take a look?

guardrex · 2026-03-12T20:18:00Z

@mattleibow ... Can #590 be closed?

mattleibow · 2026-03-12T20:43:54Z

I closed it and will do a new PR based on any extra changes later.

guardrex · 2026-03-13T18:06:03Z

I emailed Stephen, too. Stand-by for a sec to see if he wants to look at this before we merge it.

guardrex

Never heard back from Stephen. Let's go ahead, and we can react to any feedback he has later.

mattleibow added 8 commits February 12, 2026 20:31

Fix MAUI build: restore AddMauiBlazorWebView API name, update package…

eb6165f

… versions - AddMauiBlazorWebView() was incorrectly renamed during global namespace replace - MAUI packages updated to 10.0.10 (actual available version) - Microsoft.Extensions.Logging.Debug set to 10.0.0

Fix nav and CSS to match .NET 10 template

5936455

- Add missing 'nav' CSS class to <nav> element in both Web and MAUI NavMenu.razor - Update MAUI MainLayout.razor.css: add 'color-scheme: light only;' - Update MAUI NavMenu.razor.css: height -> min-height

Simplify to SQLite only

9d0af56

Remove conditional SQL Server/SQLite logic — this is a sample app, no need for cross-platform DB complexity. SQLite works everywhere.

mattleibow force-pushed the dev/maui-blazor-web-identity-10 branch from 905c5cd to a7a7c25 Compare February 13, 2026 00:43

guardrex approved these changes Mar 17, 2026

View reviewed changes

guardrex merged commit 5aeb2f1 into dotnet:main Mar 17, 2026
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add .NET 10 MauiBlazorWebIdentity sample#647

Add .NET 10 MauiBlazorWebIdentity sample#647
guardrex merged 9 commits intodotnet:mainfrom
mattleibow:dev/maui-blazor-web-identity-10

mattleibow commented Feb 12, 2026

Uh oh!

guardrex commented Mar 5, 2026 •

edited

Loading

Uh oh!

mattleibow commented Mar 12, 2026

Uh oh!

guardrex commented Mar 12, 2026

Uh oh!

guardrex commented Mar 12, 2026

Uh oh!

mattleibow commented Mar 12, 2026

Uh oh!

guardrex commented Mar 13, 2026

Uh oh!

guardrex left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mattleibow commented Feb 12, 2026

Overview

What the sample demonstrates

What's new in .NET 10

Passkey support (Identity Schema v3)

NotFound page

ReconnectModal component

App.razor modernization

Identity page updates

Other .NET 10 updates

Architecture decisions

Preserved from 9.0 (unchanged)

Project structure

Testing

Uh oh!

guardrex commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mattleibow commented Mar 12, 2026

Uh oh!

guardrex commented Mar 12, 2026

Uh oh!

guardrex commented Mar 12, 2026

Uh oh!

mattleibow commented Mar 12, 2026

Uh oh!

guardrex commented Mar 13, 2026

Uh oh!

guardrex left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

guardrex commented Mar 5, 2026 •

edited

Loading