Introduction
Microsoft states in their documentation not to use the Blazor client for authorization.
In Blazor WebAssembly apps, authorization checks can be bypassed because all client-side code can be modified by users. The same is true for all client-side app technologies, including JavaScript SPA frameworks or native apps for any operating system. Always perform authorization checks on the server within any API endpoints accessed by your client-side app.
The way I understand it, the claims of an access token are merely a non-binding information for the Blazor client, so that the correct information is shown. Users could still view content protected by <AuthorizeView Policy="IsSomebodySpecial">, even if they don't have the necessary claims for that policy in their access token.
Problem Statement
The burden of proof is on my side now to prevent a design that relies on the client for authorization, while the accessed API has no authorization.
Question
How can one bypass the authorization check in the browser to demonstrate the security risk?