title: Securing a SPA by authorization server before first load
body: <p>I am using the 'new' project templates for angular SPA applications in dotnet core 2.1 as written in the article <a href="https://docs.microsoft.com/en-us/aspnet/core/spa/angular?view=aspnetcore-2.1&amp;tabs=visual-studio" rel="noreferrer">Use the Angular project template with ASP.NET Core</a>.</p>
  
  <p>But this article doesn't mention anything about securing the SPA itself.
  All information i find is about securing a WEBAPI but first of all i am interested in securing the SPA.</p>
  
  <p>That means: When i open up my SPA e.g. <a href="https://localhost:44329/" rel="noreferrer">https://localhost:44329/</a> i would like to be redirected to the authorization server <em>immediatly</em> instead of clicking some button that will do the authentication.</p>
  
  <p>Background: </p>
  
  <ul>
  <li>I have to ensure that only a authenticated users are allowed to see the SPA.</li>
  <li>I want to use <em>Authorization Code Grant</em> to get refresh tokens from my authorization server. </li>
  <li>I cannot use <em>Implicit Grant</em> because refresh tokens cannot be kept private on the browser</li>
  </ul>
  
  <p><strong>Current approach</strong> is to enforce a MVC policy that requires a authenticated user. But this can only be applied to a MVC Controller. That's why i added <em>HomeController</em> to serve the first request. </p>
  
  <p>See project structure:</p>
  
  <p><a href="https://i.stack.imgur.com/8Rk1h.png" rel="noreferrer"><img src="https://i.stack.imgur.com/8Rk1h.png" alt="enter image description here"></a></p>
  
  <p>My Startup.cs:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddAuthentication(options =&gt;
          {
              options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              options.DefaultChallengeScheme = "CustomScheme";
          })
          .AddCookie()
          .AddOAuth("CustomScheme", options =&gt;
          {
              // Removed for brevity
          });
  
      services.AddMvc(config =&gt;
      {
          // Require a authenticated user
          var policy = new AuthorizationPolicyBuilder()
              .RequireAuthenticatedUser()
              .Build();
          config.Filters.Add(new AuthorizeFilter(policy));
      });
  
      // In production, the Angular files will be served from this directory
      services.AddSpaStaticFiles(configuration =&gt;
      {
          configuration.RootPath = "ClientApp/dist";
      });
  }
  
  // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  {
      if (env.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
      }
      else
      {
          app.UseExceptionHandler("/Home/Error");
      }
  
      app.UseAuthentication();
  
      app.UseStaticFiles();
      app.UseSpaStaticFiles();
  
      app.UseMvc(routes =&gt;
      {
          routes.MapRoute(
              name: "default",
              template: "{controller=Home}/{action=Index}/{id?}");
      });
  
      app.UseSpa(spa =&gt;
      {
          spa.Options.SourcePath = "ClientApp";
  
          if (env.IsDevelopment())
          {
              spa.UseAngularCliServer(npmScript: "start");
          }
      });
  }
  </code></pre>
  
  <p><strong>Current behaviour:</strong> When i spin up my SPA i'm immediately redirected to my authorization server because of the MVC policy. After successful authentication i see the <em>Index</em> method of the home controller but not my SPA.</p>
  
  <p>So the question is how should i serve my SPA after i have been redirected from authentication server?</p>