Browser Token not working on dashboard over HTTP

[afscrome]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Browser token auth does not seem to be working in the dashboard when being run over HTTP

Expected Behavior

Browser token auth should work.

Steps To Reproduce

1. Run an app host with the below launch settings. (I was using /playground/FileBasedApp, but I think any app will do)
2. Go to https://localhost:15233/login?t=token in your browser - This loads as expected
3. Go to http://localhost:15234/login?t=token - it prompts you for a token. If you enter your token, you end up in an infinite loop of re-promting for a token

(If it makes a difference, I'm specifically using safari on a Mac)

    "https": {
      "commandName": "Project",
      "dotnetRunMessages": true,
      "launchBrowser": true,
      "applicationUrl": "https://localhost:15233;http://localhost:15234",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development",
        "DOTNET_ENVIRONMENT": "Development",
        "ASPIRE_DASHBOARD_OTLP_ENDPOINT_URL": "http://localhost:21456",
        "ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL": "http://localhost:22678",
        "ASPIRE_ALLOW_UNSECURED_TRANSPORT": "true",
        "ASPIRE_DASHBOARD_FRONTEND_BROWSERTOKEN": "token"
      }
    },

Exceptions (if any)

No response

Aspire doctor output

No response

Anything else?

From the dashboard logs, I can see that an initial sign in is made, but the auth is immediately lost after.

Also for avoidance of doubt, I repro this on main, nothing to do with my refactor in #16046

{"EventId":10,"LogLevel":"Information","Category":"Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler","Message":"AuthenticationScheme: Cookies signed in.","State":{"Message":"AuthenticationScheme: Cookies signed in.","AuthenticationScheme":"Cookies","{OriginalFormat}":"AuthenticationScheme: {AuthenticationScheme} signed in."}}
Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler: Information: AuthenticationScheme: Cookies signed in.
{"EventId":2,"LogLevel":"Information","Category":"Microsoft.AspNetCore.Authorization.DefaultAuthorizationService","Message":"Authorization failed. These requirements were not met:\nClaimsAuthorizationRequirement:Claim.Type=BrowserTokenClaim","State":{"Message":"Authorization failed. These requirements were not met:\nClaimsAuthorizationRequirement:Claim.Type=BrowserTokenClaim","Reason":"These requirements were not met:\nClaimsAuthorizationRequirement:Claim.Type=BrowserTokenClaim","{OriginalFormat}":"Authorization failed. {Reason}"}}
Microsoft.AspNetCore.Authorization.DefaultAuthorizationService: Information: Authorization failed. These requirements were not met:
ClaimsAuthorizationRequirement:Claim.Type=BrowserTokenClaim
{"EventId":12,"LogLevel":"Information","Category":"Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler","Message":"AuthenticationScheme: Cookies was challenged.","State":{"Message":"AuthenticationScheme: Cookies was challenged.","AuthenticationScheme":"Cookies","{OriginalFormat}":"AuthenticationScheme: {AuthenticationScheme} was challenged."}}
Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler: Information: AuthenticationScheme: Cookies was challenged.
{"EventId":12,"LogLevel":"Information","Category":"Aspire.Dashboard.Authentication.FrontendCompositeAuthenticationHandler","Message":"AuthenticationScheme: FrontendComposite was challenged.","State":{"Message":"AuthenticationScheme: FrontendComposite was challenged.","AuthenticationScheme":"FrontendComposite","{OriginalFormat}":"AuthenticationScheme: {AuthenticationScheme} was challenged."}}
Aspire.Dashboard.Authentication.FrontendCompositeAuthenticationHandler: Information: AuthenticationScheme: FrontendComposite was challenged.
Aspire.Dashboard.Model.Assistant.AIContextProvider: Information: AI is disabled in configuration.
{"EventId":0,"LogLevel":"Information","Category":"Aspire.Dashboard.Model.Assistant.AIContextProvider","Message":"AI is disabled in configuration.","State":{"Message":"AI is disabled in configuration.","{OriginalFormat}":"AI is disabled in configuration."}}

[MihuBot]

I'm a bot. Here is a possible related and/or duplicate issue (I may be wrong):

• [WebToolsE2E][Aspire][Mac] There is no response and can't go to aspire dashboard page when running the Aspire app with "http" and open URL with token in the Safari browser. #4413