First, I am trying to understand how to protect blazor application from attacks. I have a JavaScript function that calls c # code. I've noticed that when I publish a project, the static files are not obfuscated. This means that I can see the code of my js files on the client side and I can easily modify these files. I wonder how to protect this situation as an attacker can inject an infinite loop into my application, then the server side CPU will process this call.
For example:
I have line:
callback.invokeMethodAsync('OnEvent', "sample data");
attacker can write this in devtool on client side:
while(true)
callback.invokeMethodAsync('OnEvent', "sample data");
Then my application processes infinitely with the method:
OnEvent(string data)
The second problem is the transparency of static files in the ./_content folder. I can see all the libraries used in my project. I think this is a potentially dangerous problem because when the library manufacturer makes a vulnerability, my entire application is exposed to attack. Has anyone had a similar problem? Maybe there is a way to fix these imperfections.