Possible to call api's directly from WASM (Client)?

[StefH]

Hello @damienbod ; Thanks for your blog post and this example project.

I was wondering if it's possible to call API's directly from the WASM client, without using a Blazor Server project ?

See picture below:

[damienbod]

Hi @StefH

Yes this is possible but do you want to do this? With this setup, you have to manage 3 access tokens in the browser and store these to the local/session storage. You also must make all three apis public. This is why maybe an API or a Blazor server in-between would reduce the attack surface, only one API would be public, the other two private. This does not need to be a Blazor server project, could be just one API which proxies other request on the further APIs.

Greetings Damien

[StefH]

Hello @damienbod, Thanks for your answer.

Currently I've the Delegated flow working. Can you please comment if this is correctly configured?

App Registration - Client

App Registration - Server

C# code from client

builder.Services.AddHttpClient("BlazorAzureADWithApis.ServerAPI")
    .AddHttpMessageHandler(sp =>
    {
        var handler = sp.GetService<AuthorizationMessageHandler>()
            .ConfigureHandler(
                authorizedUrls: new[] { ServiceApiUrl },
                scopes: new[] { "api://61b557d0-0018-4f72-8a7d-6145a941962d/Application.Access" }
            );

        return handler;
    });

builder.Services.AddMsalAuthentication(options =>
{
    builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);

    // Add the 'delegated' scope
    options.ProviderOptions.DefaultAccessTokenScopes.Add($"api://{options.ProviderOptions.Authentication.ClientId}/access_as_user");
});

Note that for the delegated flow, I dont need to store tokens manually.