[area-blazor] Failed to run Blazor web App with Exception: "Endpoint / (/) contains anti-forgery metadata, but a middleware was not found that supports anti-forgery" after installing 11.0 Preview 7

[jinzhao1127]

REGRESSION INFO: Works well on 11.0 Preview 6

INSTALL STEPS:

1. Clean Win11 x64 25h2 ENU
2. Install the .NET 11.0 Preview 7 SDK: https://aka.ms/dotnet/11.0.1xx/daily/dotnet-sdk-win-x64.exe
3. Add feed

Platform

• Windows
• macOS
• Linux

Repro Steps

1. Open a normal Command Prompt
2. Create a Blazor web project and run it

   dotnet new blazor -o Blazor
   cd Blazor
   dotnet run 
   

3. Open URL in browser

Actual Result
Webpage failed to load with "InvalidOperationException: Endpoint / (/) contains anti-forgery metadata, but a middleware was not found that supports anti-forgery."

Note

1. This issue also reproduces on 11.0 Blazor Web (webassembly/Auto) app
2. This issue does not reproduces on Blazor WebAssembly Standalone app.
3. This issue related with Remove redundant app.UseAntiforgery() from Blazor Web templates #67119 change.
4. Workaround: add app.UseAntiforgery(); in Program.cs file.

Stack:

System.InvalidOperationException: Endpoint / (/) contains anti-forgery metadata, but a middleware was not found that supports anti-forgery.
Configure your application startup by adding app.UseAntiforgery() in the application startup code. If there are calls to app.UseRouting() and app.UseEndpoints(...), the call to app.UseAntiforgery() must go between them. Calls to app.UseAntiforgery() must be placed after calls to app.UseAuthentication() and app.UseAuthorization().
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.ThrowMissingAntiforgeryMiddlewareException(Endpoint endpoint)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.HttpsPolicy.HttpsRedirectionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddlewareImpl.Invoke(HttpContext context)

[javiercn]

@DeagleGross can you confirm this is what we fixed?

[DeagleGross]

I can repro on latest preview-7 sdk 11.0.0-preview.7.26358.120. However, it does not have the fix from #67618 (see ILSpy old code):

• CsrfProtectionMiddleware has old version setting verdict on endpoint is null case

public Task InvokeAsync(HttpContext context)
{
	Endpoint? endpoint = context.GetEndpoint();
	IAntiforgeryMetadata antiforgeryMetadata = endpoint?.Metadata.GetMetadata<IAntiforgeryMetadata>();
	if (endpoint == null || antiforgeryMetadata != null)
    ...

• EndpointRoutingMiddleware does remove the PostRoutingPipeline in ctor:

_routeOptions = routeOptions.Value;
if (endpointRouteBuilder is IApplicationBuilder applicationBuilder && 	applicationBuilder.Properties.TryGetValue("__Internal_PostRoutingPipeline", out object value))
{
    applicationBuilder.Properties.Remove("__Internal_PostRoutingPipeline");

I've published a self-contained template app via dotnet publish -c Release -r win-x64 --self-contained true and replaced it with dlls built from main branch and template started to work. So I'll close this issue. Workaround is to wait for new preview to be published and use that one instead.

[jinzhao1127]

Verify this bug on the latest 11.0 P7[11.0.100-preview.7.26359.119], it was fixed now.