Applying security

Here, we will see how we can enforce security rules in a Blazor app. In this context, we will we cover authentication and authorization, the two main topics of security, and also briefly talk about Cross-Origin Resource Sharing (CORS).

Requesting authorization

Blazor uses the same authentication mechanism as ASP.NET Core—that is, based on cookies: if we are authenticated to ASP.NET Core, then we are authenticated to Blazor. As for authorization, Blazor resources (pages) are protected by applying an [Authorize] attribute, with or without properties (roles or policies—policies are more generic). Attributes can be applied to a page either by applying an @attribute directive on a .razor file or on a .cs code-behind file, like this:

          @
          attribute
          [Authorize(Roles = "Admin")]