Here, we will see how we can enforce security rules in a Blazor app. In this context, we will we cover authentication and authorization, the two main topics of security, and also briefly talk about Cross-Origin Resource Sharing (CORS).
Requesting authorization
Blazor uses the same authentication mechanism as ASP.NET Core—that is, based on cookies: if we are authenticated to ASP.NET Core, then we are authenticated to Blazor. As for authorization, Blazor resources (pages) are protected by applying an [Authorize] attribute, with or without properties (roles or policies—policies are more generic). Attributes can be applied to a page either by applying an @attribute directive on a .razor file or on a .cs code-behind file, like this:
@
attribute
[Authorize(Roles = "Admin")]
Mind you, it is pointless to apply [Authorize] attributes to components—they only make sense...
