Implementing anti forgery validation for Blazor UI application

user_11483554 0
Viewed 1222

Our application is built using Blazor Server and .razor pages which communicates to Azure APIs. I would like to know if for Blazor UI should we implement Anti forgery CSRF/XSRF, if so can I get some information how to implement?

I have observed posts implementing Anti forgery for ASP .Net core MVC applications https://exceptionnotfound.net/using-anti-forgery-tokens-in-asp-net-core-razor-pages/ and also blogs mentioned that Razor pages implement Anti forgery validation by default.

But for Blazor would like to know what is the pattern to follow ?

asp.net-blazor blazor-server-side blazor csrf
1 Answers

From the Microsoft documentation:

Blazor Server apps can be accessed cross-origin unless additional measures are taken to prevent it. To disable cross-origin access, either disable CORS in the endpoint by adding the CORS middleware to the pipeline and adding the DisableCorsAttribute to the Blazor endpoint metadata or limit the set of allowed origins by configuring SignalR for cross-origin resource sharing.

If CORS is enabled, extra steps might be required to protect the app depending on the CORS configuration. If CORS is globally enabled, CORS can be disabled for the Blazor Server hub by adding the DisableCorsAttribute metadata to the endpoint metadata after calling MapBlazorHub on the endpoint route builder.

user_10261230
Related