Document SignalR authentication refresh endpoint, refresh context, and hub override

[Copilot]

The .NET 11 SignalR authentication refresh feature is already covered in depth in xref:signalr/authn-and-authz, but four elements were missing: the /refresh endpoint has no route, method, or registration semantics documented anywhere; AuthenticationRefreshContext members are used in examples but never listed; OnAuthenticationRefreshedAsync isn't discoverable from the Hubs API article; and the .NET client article has no path to the feature. These changes fill those gaps without rewriting or duplicating the existing Authentication refresh section.

Changes

• aspnetcore/signalr/authn-and-authz.md (inside the existing >= aspnetcore-11.0 zone)
  • Describes the /refresh endpoint: route template {hub-path}/refresh, POST-only (405 otherwise), connection token in the id query string, the 200 + tokenLifetimeSeconds success payload, and the 403/404/400 failures carrying an error property. Notes that the endpoint is registered only when EnableAuthenticationRefresh is true, plus guidance to allow the route through reverse proxies, firewalls, and route-scoped authorization/CORS policies.
  • Lists the AuthenticationRefreshContext properties (PreviousUser, NewUser, NewExpiration, ConnectionId, HttpContext), including that MaximumAuthenticationExpiration is applied before the callback runs.
• aspnetcore/signalr/hubs.md — surfaces OnAuthenticationRefreshedAsync in "Handle events for a connection" alongside OnConnectedAsync/OnDisconnectedAsync, cross-referencing the full feature rather than duplicating it. Requires splitting the enclosing >= aspnetcore-8.0 moniker zone.
• aspnetcore/signalr/dotnet-client.md — adds a short >= aspnetcore-11.0 section pointing to the feature.
• Metadata: ms.date bumped on all three articles; ai-usage: ai-assisted added to hubs.md and dotnet-client.md.

Two corrections relative to the issue's proposed text

Each new statement was verified against product source in dotnet/aspnetcore @ 1fcd7ef, which contradicted the issue in two places:

1. Callback exceptions. The issue proposed "if the callback throws, the refresh is rejected." The HttpConnectionDispatcherOptions.OnAuthenticationRefresh invocation isn't wrapped in a try/catch (HttpConnectionContext.cs:366-374), so the exception propagates out of the /refresh request — asserted by RefreshOnAuthenticationRefreshCallbackExceptionPropagates. Only the connection-level IConnectionAuthenticationRefreshFeature callback has throw-means-reject semantics. The documented behavior reflects the former.

2. Client auto-refresh default. HubConnection falls back to new AuthenticationRefreshOptions() when none are registered (HubConnection.cs:286), so auto-refresh is on by default and WithAuthenticationRefresh only retunes or disables it — it isn't the opt-in switch. The existing sentence ("To refresh automatically… call WithAuthenticationRefresh") would have contradicted the new client-article text, so it was adjusted:

-To refresh automatically before the token expires, call `WithAuthenticationRefresh` and configure `AuthenticationRefreshOptions`:
+Automatic refresh is enabled by default. The client schedules a refresh ahead of the reported expiration whenever the server reports a token lifetime. To change the timing or to turn automatic refresh off, call `WithAuthenticationRefresh` and configure `AuthenticationRefreshOptions`:

This one-sentence fix is the only edit outside the four listed gaps. No TOC or redirection changes are needed.

• Fixes v11 update: SignalR authentication refresh #37691

---

Internal previews

File	Preview link
aspnetcore/signalr/authn-and-authz.md	Learn preview
aspnetcore/signalr/dotnet-client.md	Learn preview
aspnetcore/signalr/hubs.md	Learn preview

Build report