Patterns for applying authz across Blazor apps - #37501
Open
guardrex wants to merge 9 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates ASP.NET Core documentation to describe patterns for requiring authorization across Blazor hosting models (server-side vs WebAssembly), with cross-links from the general authorization docs and related Blazor security pages.
Changes:
- Adds a new “Patterns to require authorization” section for server-side Blazor apps (including guidance for fallback policy +
AllowAnonymousand static assets considerations). - Updates Blazor WebAssembly security guidance to frame authorization as patterns and clarifies fallback policy limitations for WASM.
- Standardizes wording around
_Imports.razor(as “imports file”), refreshes metadata dates, and adds cross-links from the authorization introduction page.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| aspnetcore/security/authorization/simple.md | Small wording tweak describing applying [Authorize] via imports file. |
| aspnetcore/security/authorization/introduction.md | Updates ms.date, improves namespace section with API xrefs, and adds links to Blazor authorization patterns. |
| aspnetcore/mvc/views/razor.md | Updates note wording around the imports file used for @rendermode shorthand. |
| aspnetcore/blazor/security/webassembly/index.md | Renames/reshapes the “require authorization” section into patterns and clarifies fallback policy limitations in WASM. |
| aspnetcore/blazor/security/index.md | Adds links to the new authorization-pattern sections and updates ms.date. |
| aspnetcore/blazor/security/additional-scenarios.md | Adds a substantial new section describing global vs local authorization patterns for server-side Blazor, plus metadata/title updates. |
| aspnetcore/blazor/globalization-localization.md | Standardizes wording around _Imports.razor references. |
| aspnetcore/blazor/components/render-modes.md | Standardizes wording around _Imports.razor references. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
wadepickett
self-requested a review
August 26, 2026 19:10
wadepickett
reviewed
Aug 26, 2026
wadepickett
approved these changes
Aug 26, 2026
wadepickett
left a comment
Contributor
There was a problem hiding this comment.
@guardrex: Aproved but see my very minor suggestion inline.
Co-authored-by: Wade Pickett <wpickett@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #24473
Updates ASP.NET Core documentation to describe patterns for requiring authorization across Blazor hosting models (server-side vs WebAssembly), with cross-links from the general authorization docs and related Blazor security pages.
Stephen ... Some guesses and draft language here as usual, including for section headings. Also, let me know which section should appear first (fallback policy with anonymous access holes or securing individual/groups of endpoints), and I'd like to mark your recommended approach for readers.
Internal previews