Since Blazor (server) apps should not use IHttpContextAccessor, how can we read this information in an IAuthorizationHandler?

Question

I keep reading that IHttpContextAccessor should not be used with Blazor applications at all. However, the suggested approaches all seem to focus only on usage within a component. I am trying to access the http context during policy authorization, and I don't see a clear way to do this without injecting IHttpContextAccessor. Is it problematic during authorization as well?

MS specifically says:

Additionally, again for security reasons, you must not use IHttpContextAccessor within Blazor apps. Blazor apps run outside of the context of the ASP.NET Core pipeline. The HttpContext isn't guaranteed to be available within the IHttpContextAccessor, nor is it guaranteed to be holding the context that started the Blazor app.

Edit: This is not a duplicate question as I am talking about a specific location and a different era of Blazor (Microsoft's statement basically forbidding its use entirely didn't exist at the time of the question mine supposedly duplicates). Both the question and answers there do not address my specific use case (during authorization). I am asking about a specific place in which the _Host.cshtml is irrelevant as the authorization handler code is executed before _Host according to the order my breakpoints are being hit.

Answer 1

If you have to use the HttpContext then you have to get the desired value(s) from HttpContext when rendering _Host.cshtml and save it in a variable and use that variable in the form of Cascading Parameters in the components in the rest of the program.

For example, I use the following procedure to get HttpContext in Blazor Server web application.

I modify the _Host.cshtml file as follows firstly. Here I'm looking for access_token information.

@{
    var token = await HttpContext.GetTokenAsync("access_token");
}

As you can see, I put the access_token information into the token variable and assign it to the component's param-AccessToken. Then I go to the App.razor file and define the AccessToken variable as a Cascading Value. As follows:

<CascadingValue Name="AccessToken" Value="AccessToken">
<CascadingAuthenticationState>
    <Router AppAssembly="@typeof(Program).Assembly">
        <Found Context="routeData">
            <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)" />
        </Found>
        <NotFound>
            <LayoutView Layout="@typeof(MainLayout)">
                <p>Sorry, there's nothing at this address.</p>
            </LayoutView>
        </NotFound>
    </Router>
</CascadingAuthenticationState>

@code{
    [Parameter]
     public string AccessToken { get; set; }
 }

Finally, any components that need an AccessToken value just need to define it as a Cascade Parameter. For example, I create a component called ShowToken.razor and put its codes as below:

@page "/showtoken"

<p>This is part of the access token @(AccessToken != null ? AccessToken.Substring(0,30) : "(null)")</p>


@code {
    [CascadingParameter(Name = "AccessToken")] public string AccessToken { get; set; }
}

Because you receive HttpContext in the _Host.cshtml, so it will not threaten your program in terms of security.