protected-page-token-warmup

Authentication redirect loops happen when eager cookie renewal or token warming triggers repeated redirects before the page renders. Deferring downstream token refresh operations until an API action explicitly requires a bearer token eliminates this churn.

To stop auth-cookie refresh from blocking rendering, separate page rendering logic from bearer token acquisition by removing token-refresh logic from the controller's initial render method and moving it into downstream API actions.

You should defer bearer token retrieval when eager token warming causes performance degradation or redirect loops. This pattern applies to server-rendered apps where protected pages must render immediately without waiting for downstream token refresh operations.

Yes, deferring token refresh works for protected Umbraco dashboards by allowing the dashboard to render immediately while bearer token retrieval is handled by the specific service calls that actually need it.

The best way to decouple rendering from token acquisition is to architecturally separate page rendering logic from bearer token acquisition processes, ensuring token refresh middleware only triggers when API actions explicitly require authentication.

Yes, eager token warming causes performance degradation in server-rendered authentication flows by triggering unnecessary downstream token refresh operations during initial page rendering instead of waiting until API actions require them.