The current environment is Blazor Wasm, and the API tool used is Refit, and the current requirement is to bring the AD information in the Windows domain when logging in to request the API in exchange for a token

[W2426566602]

But when I set httpclient's UseDefaultCredentials runtime, it will get an error, of course I know the reason, because this is a server-side function, so I want to ask how to do this scenario

[glennawatson]

This is a platform limitation, not a Refit one. In Blazor WebAssembly all HTTP requests go through the browser fetch API, so HttpClientHandler.UseDefaultCredentials and Windows/AD integrated auth are not available - the browser sandbox does not expose the Windows domain identity to WASM. That is why you get the runtime error.

Options for the WASM scenario:

• Do the Windows/AD authentication on the server. Host an ASP.NET Core endpoint that uses Windows Authentication (Negotiate/Kerberos) to identify the user, issue a token (JWT), and have the Blazor WASM app call that endpoint to exchange the domain identity for a token. The browser handles the Negotiate handshake for same-origin requests if the site itself is configured for Windows auth.
• From then on, attach the token to Refit calls with an authorization handler:

services
    .AddRefitClient<IMyApi>()
    .ConfigureHttpClient(c => c.BaseAddress = new Uri(BaseUrl))
    .AddHttpMessageHandler(() => new AuthHeaderHandler(tokenProvider));

• For credentialed cross-origin calls you can set BrowserRequestCredentials via a DelegatingHandler (SetBrowserRequestCredentials(BrowserRequestCredentials.Include)), but that sends cookies, not Windows credentials.

Short version: capture the AD identity server-side and exchange it for a token; Refit then just carries the token. There is nothing Refit can set to make WASM use Windows credentials directly.