Skip to content

Patterns for applying authz across Blazor apps - #37501

Open
guardrex wants to merge 9 commits into
mainfrom
guardrex/blazor-authz-patterns
Open

Patterns for applying authz across Blazor apps#37501
guardrex wants to merge 9 commits into
mainfrom
guardrex/blazor-authz-patterns

Conversation

@guardrex

@guardrex guardrex commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Fixes #24473

Updates ASP.NET Core documentation to describe patterns for requiring authorization across Blazor hosting models (server-side vs WebAssembly), with cross-links from the general authorization docs and related Blazor security pages.

Stephen ... Some guesses and draft language here as usual, including for section headings. Also, let me know which section should appear first (fallback policy with anonymous access holes or securing individual/groups of endpoints), and I'd like to mark your recommended approach for readers.


Internal previews

File Preview link
aspnetcore/blazor/fundamentals/static-files.md aspnetcore/blazor/fundamentals/static-files
aspnetcore/blazor/security/additional-scenarios.md aspnetcore/blazor/security/additional-scenarios
aspnetcore/blazor/security/index.md aspnetcore/blazor/security/index
aspnetcore/blazor/security/webassembly/index.md aspnetcore/blazor/security/webassembly/index
aspnetcore/security/authorization/introduction.md aspnetcore/security/authorization/introduction

@guardrex guardrex self-assigned this Aug 20, 2026
@guardrex
guardrex marked this pull request as ready for review August 21, 2026 15:39
@guardrex
guardrex requested a lite review from Copilot August 21, 2026 15:40

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates ASP.NET Core documentation to describe patterns for requiring authorization across Blazor hosting models (server-side vs WebAssembly), with cross-links from the general authorization docs and related Blazor security pages.

Changes:

  • Adds a new “Patterns to require authorization” section for server-side Blazor apps (including guidance for fallback policy + AllowAnonymous and static assets considerations).
  • Updates Blazor WebAssembly security guidance to frame authorization as patterns and clarifies fallback policy limitations for WASM.
  • Standardizes wording around _Imports.razor (as “imports file”), refreshes metadata dates, and adds cross-links from the authorization introduction page.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
aspnetcore/security/authorization/simple.md Small wording tweak describing applying [Authorize] via imports file.
aspnetcore/security/authorization/introduction.md Updates ms.date, improves namespace section with API xrefs, and adds links to Blazor authorization patterns.
aspnetcore/mvc/views/razor.md Updates note wording around the imports file used for @rendermode shorthand.
aspnetcore/blazor/security/webassembly/index.md Renames/reshapes the “require authorization” section into patterns and clarifies fallback policy limitations in WASM.
aspnetcore/blazor/security/index.md Adds links to the new authorization-pattern sections and updates ms.date.
aspnetcore/blazor/security/additional-scenarios.md Adds a substantial new section describing global vs local authorization patterns for server-side Blazor, plus metadata/title updates.
aspnetcore/blazor/globalization-localization.md Standardizes wording around _Imports.razor references.
aspnetcore/blazor/components/render-modes.md Standardizes wording around _Imports.razor references.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread aspnetcore/security/authorization/introduction.md Outdated
Comment thread aspnetcore/blazor/security/additional-scenarios.md Outdated
Comment thread aspnetcore/blazor/security/additional-scenarios.md Outdated

This comment was marked as outdated.

This comment was marked as resolved.

@guardrex
guardrex requested a review from halter73 August 24, 2026 19:54
@wadepickett
wadepickett self-requested a review August 26, 2026 19:10
Comment thread aspnetcore/blazor/security/webassembly/index.md Outdated

@wadepickett wadepickett left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@guardrex: Aproved but see my very minor suggestion inline.

Co-authored-by: Wade Pickett <wpickett@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Blazor Server Side AADB2C AllowAnonymous Not working in latest template

3 participants