Blazor project tracking 2022

[guardrex]

2022

For the 2021 idea list, UE pass list, and notes, see Blazor project tracking 2021 (dotnet/AspNetCore.Docs #19286).

Doc ideas

Not ALL of these will be worked. This is an idea list/check list that don't rise to the level of opening an issue at this time.

• Consider adding a code example for the MutationObserver pattern where its discussed.
• File uploads topic: Fix accessibility of the yes/no icons. Use: <span aria-hidden="true">XXXXX</span><span class="visually-hidden">XXXXX</span>
• Add guidance on the reason(s) for using partial classes and base classes (inheritance) with pros and cons of each (partial = only splitting, base class = splitting and multiple-inheritance, useful in library-provided API scenarios).
• Looks fixed, so check on the scenario for the Robot example, and then remove a NOTE if there's one there. Blazor WebAssembly lazy loading assemblies not working when using @ref attribute in the component aspnetcore#29342 (comment) PR: Remove NOTE #27716
• Update the new load progress indicator with a NIT and include the recipe for the subtle bar that Steve shows in the audio app. Add a load progress example #27543 and Patch progress indicator coverage #27591
• Per Steve's .NET Conf talk, shouldn't we briefly cover FileSystem API use in Blazor apps?
• Let's run through the testassets pieces in the framework to see what might be helpful for devs to see in docs. It's a large task tho because there's so much there. This probably can't be worked in 23H1, possibly for 23Q3 tho.
• There's great PU-provided memory leak guidance on Severe blazor server memory leak aspnetcore#43221. Take a look and see if/what could go into docs, possibly even just by linking the PU issue to cover it in the near-term.
• More for '23 than '22, I'm moving over a wrap-up item from the 7.0 tracking issue to this issue for work later: "Open an issue to replace in-text (usually non-working) examples with samples repo-based fully working cut-'n-paste examples. List the sections that require updates. This issue will be targeted for EOY or 23Q1."
• It would probably be nice to create a QuickGrid example that opens and closes a detail record component without losing the page and scroll position of the grid. For context, see Blazor database example's list page is reloaded when coming back from a details page blazor-samples#58.
• I think I need to cross-link https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/threat-mitigation?view=aspnetcore-7.0#denial-of-service-dos-attacks to the DoS NOTE on message size limit, particularly in the fundamentals signalr config guidance.
• Firefox debug support per Firefox support #27411. Check back in 23Q1 on status because there's currently no PU issue to track on.
• The state management doc is a bit scatter 🧠 with the new coverage on in-memory state preservation given the introduction is about lost state scenarios. Also, we don't do anything specific for cascading. However, this is a low priority for '22 and can be worked in 23H1 after consulting with the PU. Blazor: In-memory state container as cascading parameter #27296
• After .NET 7 releases, it's best to have PU 🐈 look over the SignalR-Blazor enhancements for SignalR config (in the SignalR doc and the WASM/Server Host and Deploy docs) and SignalR client logging (in the Logging doc).
• Blazor samples link update to http://useiconic.com. Templates link update to http://useiconic.com blazor-samples#51 PR: Update samples for MIA async modifier and template changes blazor-samples#52
• Blazor samples JS interop code update: Missing an async modifier. Update JS interop example code blazor-samples#50 PR: Update samples for MIA async modifier and template changes blazor-samples#52
• It would be nice to adopt file-scoped namespaces for 6.0 or later examples and snippet samples. This is very low priority tho! 😄 What might happen is just all new examples get the treatment.
• There's about a half-dozen or so cases of using compiler directives around the docs to control code for debug vs. release configs. Confirm that configuration/environment can't manage these cases or that using configuration/environment wouldn't make sense for them.
• Use no-loc syntax for the Client and Server project mentions of hosted WASM solutions. markdown style error #27075 (comment) PR: Update code-fencing to inline no-loc syntax #27151
• Currently, docs are mostly consistent on the instance name of an injected NavigationManager as NavigationManager. However, the PU favors Navigation in their examples. BTW, the glob-loc topic uses Nav. Consider making this consistent on Navigation everywhere, including in the snippet sample apps (and other sample apps). Update Navigation Manager naming #27153
• Cross-link CSS isolation/collocated JS and controlling <head> content in the Performance doc. Lazy-loading CSS files #26994 REJECTED because the lazy-loading scenario that would be effective is an advanced scenario that most apps probably won't benefit from very much.
• Consider making the Lifecycle topic call out that the explanations and diagrams are oversimplifications of what the framework really does, which is too complex to explain/show in the text and diagrams in a simple way. Description of first render lifecycle seems wrong #26989 PR: Cross-link reference source #27170
• Ask Tanay to review the new example at Fundamentals > DI > Utility base component classes to manage a DI scope section.
• Port this new section from Add JS interop example back to 6.0, 5.0, and 3.1. Note that requires changes on the dotnet/blazor-samples repo (rename ListItem to ListItem1, place the new ListItem2). I scribbled a note to delete Shared/ListItem.razor and to kill Pages/dependency-injection/Preferences.razor. Backport JS interop section #27517
• Moving some components to the main repo and updating route templates so that the sample apps will run. This was started on Move example code to repo #26830, and there will be one or a few PRs to finish this task over time. More work on Update Blazor sample app references #26879 and Update examples to allow building/running apps blazor-samples#38.
• Chat with Javier about the WHY aspects on MSBuild properties for hosted deployment options #26620 (comment). I'd like to know why the RID works with the MSBuild prop (/p:RuntimeIdentifier={RID} but the self-contained setting doesn't (/p:SelfContained=false).
• Chat with Tanay about https://docs.microsoft.com/en-us/aspnet/core/blazor/components/dynamiccomponent?view=aspnetcore-6.0 per Update event callback approach #26557. Is this the best way to showcase event callbacks with dymanic components?
• Add a tidbit on logging in WASM's Program.cs to the Logging topic. WASM logging in Program.cs #26449
• In JS interop examples, I use the global FN location approach as the quick, simple, cut-'n-paste approach. I think these spots could have a brief NOTE and cross-link to the JS location coverage at <xref:blazor/js-interop/index#location-of-javascript>. Cross-link JS location guidance #26166
• Move the Blazor-SignalR tutorial sample apps to the dotnet/blazor-samples repo and cross-link code to the dedicated repo. Kill 🔪 the samps in the main doc set repo. Drop Blazor-SignalR 6.0 samp and cross-link #26117
• Should we have a 'how to read cookies in code (JS interop)' piece in the JS interop (Call JS from .NET) doc (e.g., WASM culture guidance #26063 (comment))? Broadly, would it make sense to have a topic JS interop recipes with common JS interop scenarios? Rejected. I don't think we have time in the forseeable future for this, and there's no indication from the PU that such a topic is needed.
• Double-check the built-in components list (https://docs.microsoft.com/aspnet/core/blazor/components/built-in-components). Added RouteView on Add RouteView component #26100. Opened Cover SectionOutlet/SectionContent? #26099 to ask about SectionOutlet/SectionContent, but closed it immediately when Mackinnon informed me that they're internal, which I missed because I didn't read the bleed'in code! 🙈😄 I need a vacation! 🏖️
• Code cross-links to dotnet/blazor-samples repo sample apps. :::code language="csharp" source="~/../blazor-samples/6.0/BlazorSample_Server/ExampleModel.cs" highlight="6"::: https://github.com/dotnet/AspNetCore.Docs/raw/main/aspnetcore/blazor/samples/6.0/BlazorServerDbContextExample.zip Cross-ref: Updates to use the dotnet/blazor-samples repo #24883 UPDATE: Moved to the dedicated issue at Blazor cross-repo code sample links #26074. Resolved by: Blazor cross-repo code sample links #26087
• Looks like the perf topic sections are too deep to surface content well in the ToC sidebar. UPDATE (5/31): I can't fix this, so I'm marking it off the list. I added a remark on this to my 'Show More' docs issue at Poor topic navigation with new 'Show more' ToC layout MicrosoftDocs/feedback#3770 (comment).
• Consider a short focused section on RenderFragment for defining reusable, non-component rendering code in the components topic. It's currently a bit buried in the perf topic. Other docs can cross-link to it for a definition of RenderFragment with an example. Cross-links to and from this section make sense to index the various uses and examples. Besides, the child component section is the first mention of it, and it's not particularly well described at the moment in a general way there. This could be part of any updates for Is using __builder in the examples a good idea? #25822. NOTE: Search out cross-links to re-point. There's one coming up in the Hybrid 'reuse components' topic. Render fragment content organization and cross-links #26017
• Sync/async coverage for JS interop is a bit messy and needs re-org, clean up, and clarifications for IJSInProcessRuntime (3.1 or later)/IJSInProcessObjectReference (5.0 or later). Sync JS interop updates #26101
• On the diff code blocks, most have a space between the +/- and the line. A few don't ... bring those into alignment with a space. Blazor diff code fixups #25983
• Per guidelines, we're supposed to avoid "log"-based auth session wording (e.g., "log in"/"log out") in favor of "sign"-based terminology (e.g., "sign in"/"sign out"). I've asked DR what he thinks because the PU regularly sends me "log"-based wording in PU content/code samples. We might need a PR to adjust the lingo globally. UPDATE (5/3): The word is given: The PU prefers "log{in|out|into|out of}" wording in framework naming, including in the project templates, so we'll ignore the doc division guidance on this point. The docs can probably just continue with a mix, since these are used interchangeably by the whole industry.
• There's an "Unhandled Exceptions" folder of docs in my browser. One cross-ref is to some debugging code that Javier recommended to a dev to log some debug details. Check and make sure that that scenario is covered. Check the other docs to see if there's anything useful to add to the docs. UPDATE: Only found a tiny NIT to fix. We have Error Boundaries. We have Steve's alternative global exception handling section (i.e., custom error component as a cascading value). We have good logging coverage in the Logging topic. I think we're good here (sans logging in Program.cs, but I'm going to add a nibblet on that shortly).
• Consider recasting or providing more explicit details on subdomain multiple WASM app hosting scenario at Hosted deployment with multiple Blazor WebAssembly apps per request at Hosted deployment with multiple Blazor WebAssembly apps on different subdomains #25723. PR: Multiple hosted Blazor WASM with RP or MVC #25754
• Make a RexHax™ 🙈 custom logger that deals with log scopes, place it into the dotnet/blazor-samples repo and link to it there. Note to self: It's on the I: drive! 😄 Blazor WASM logging coverage enhancements #25705 (comment) UPDATE: Checking this off here because it's going to be tracked by its own issue at: Place log scopes sample into the Blazor samps repo #25982
• A number of code examples don't leverage implicit namespaces for .NET 6 or later. I think it's very important to address this before reaching .NET 7, so I've opened Drop implicit namespaces in 6.0 sample app components #25702 to fix up the examples. Drop implicit namespaces #25733 & Drop implicit namespaces blazor-samples#10 Note: IntelliSense doesn't indicate implicit @using directives in components, so I'll table that aspect for a future VS release that can help identify them.
• Drop ReferenceParent3 example from the docs sample repo. Drop example blazor-samples#7
• Add ".NET MAUI" and "Mac Catalyst" to no-loc metadata. Blazor Hybrid dev tools topic #25384 (comment) Blazor no-loc adds #25429
• For all of the 'add a package reference' guidance, use the INCLUDE to explain where the reader can get more info: [!INCLUDE[](~/includes/package-reference.md)]. Improve add package ref guidance #25260
• Walk the main doc set logging topic and identify which scenarios don't work/aren't relevant for Blazor WASM logging and call them out in the Blazor WASM section of the Blazor logging topic. It will be a sister update to the work that's being put in now on Missing Information on WebAssembly Logging and JS Console Interop #25172. PR: Blazor WASM logging coverage enhancements #25705
• Purge lingering (sneaky 😈) 'Blazor component' naming in the docs. Most of these came in from PU content that I didn't catch on edits 🙈, but it's been dealt with fully in the Blazor docs now. Update 'Blazor component' naming #25118 ... Successful thus far with external doc sets: .NET MAUI docs, .NET docs, and I created a private (hidden) issue for Learn Modules. Change "Blazor component" to "Razor component" docs#28324 Use "Razor component" and avoid "Blazor component" maui#4830 This work is on-going as I find and report it to other doc set maintainers.
• Take a look at Saving Files in File System directly in Blazor Web Assembly #25103 for File Uploads (WebAssembly scenario). Standalone WASM file upload enhancements #25160
• Blazor SEO: Perform a meta description and first sentence review on the whole Blazor docs node. Look for opportunities to improve them. Blazor SEO pass #25311
• For August: Re-assess success for changes on Improve Blazor Hosting Models article SEO #24878. UPDATE (4/25): I'm checking this off per DR's remark that he's cool with the approaches taken to improve the SEO for the article.
• See Update RCL control of <head> content guidance #24868 (comment) ... We don't want to show an example of using a HeadContent component that adds a global stylesheet from an RCL. It works, but it isn't recommended. It's an advanced scenario that devs can use at their own risk. Update guidance on global RCL stylesheet use #25161
• I had to remove the AOT definition cross-link. It was pointing to our .NET glossary definition, but there are problems with linking that content at the moment. I opened Can the AOT definition be updated so that Blazor WASM docs can link to it? docs#27934 to see if updates can be made, but it was ignored by the .NET docs folks. Update (3/9): After looking the guidance over, I'm happy with what we have at this time. "AOT" is described clearly, along with the "hybrid"/"mixed-mode" aspect (without using those terms) (i.e., it still requires the managed DLLs). I'm going to check this item off as a won't fix scenario.
• Take a look at how the sample is linked into the SignalR-Blazor tutorial and the EF Core doc to react to devs mistakenly thinking that they need it in advance as a prereq. There is no sample app source code #24670 (comment) Clarifications on the sample app #24684
• For the DI topic where [Inject] is described: Injected properties are expected to be available, so make them non-nullable. Added IServiceProvider to DataAnnotationsValidator aspnetcore#39445 (comment) Injected properties are expected to be available #24685
• Confirm runtime relinking guidance stating that it's a publish-and-Release config gesture. Building a project-template-based test app produced a 51.5 MB app. Publishing in Debug resulted in a 9.3 MB app without relevant console compiler output. Publishing in Release resulted in a 6.6 MB app with console compiler output that indicated runtime relinking.
• When Document blazor msbuild configuration options docs#27395 is resolved and Mono/WASM MSBuild props are covered, update the cross-links from the targets file to the new official doc. Links can be located on the PR that added them at Mono/WASM MSBuild property guidance #24493.
• It seems like everyplace that we have hosted WASM, we should call out that the project must be run from the Server project. The errors for not doing so can be quite cryptic 😵. For example, the File Uploads topic example throws a "JSON token" error when the solution is run from the client app. It's not at all clear that it was simply run from the wrong project.
• In the Prerender and Integrate topic, clarify the line that speaks to the dev starting with RP/MVC and then including Blazor Server app in order to render components from pages/views. About component's render from Razor Page #23948 (comment) Related: I add a HeadOutlet component to the layout at Line 212 for the scenario of an RP/MVC app that embeds components from a hosted WASM app (render-mode="ServerPrerendered") to allow components to control head content. Due to time constraints at the moment, the coverage is going in. When I address this item and touch that line ☝️ also run a quick test and confirm the scenario for Line 212 actually works ... or did I just make up a new Blazor feature all by myself?! 🙈😄 The last piece was fixed as part of Update Blazor code guidance #24548 prompted by a user issue. The first bit is fixed by Fix confusing language #24665.
• InputFile component preview guidance (6.0) is in the new Blazor Images topic and probably should be better cross-linked (Blazor Wasm InputFile Preview Content Faster #23802). InputFile image preview INCLUDE #24666
• For passing extra params to elements with Action delegates, I whipped up a (contrived) example on Example update #23566 (comment). It's not particularly complicated to enhance the example that appears in the Perf topic. I'm going to merely leave the test case on that PR comment for the time being.
• Ask RA for an internal issue on pivot search results. The problem is that the whole topic is indexed but the links to the topics don't point to the pivot where the content lives ... the topic loads with whatever default pivot the user has selected earlier (or the default). I think the search results should be by-pivot with a clear pivot indication and with a pivot-specific landing link. This would mean that it's possible for the reader to receive two or more search result links, but the reader would be taken directly to the pivot and not get confused when the land to find no content for what they searched. UPDATE (1/31): Sent an email to the docs team on 1/31/2022 with DR and Artak copied. This is considered 'closed' for Blazor work until they resolve it. In the few spots that we use pivots in Blazor docs, I'll maintain NOTEs where needed to surface alternative pivot coverage.
• For Blazor AOT, add remark ... .NET 6.0 RC1 on macOS Apple M1: Blazor WASM AOT build generates & serves both, large dotnet.wasm and all the .DLLs aspnetcore#37092 (comment) ... also see 👉 Blazor AOT .Net6 Preview 7 - Still downloading Dlls aspnetcore#35302 Enhance AOT WASM load-time/runtime perf remarks #24686
• Ping Pranav to take a look at the new guidance at https://docs.microsoft.com/en-us/aspnet/core/blazor/performance?view=aspnetcore-6.0#avoid-recreating-delegates-for-many-repeated-elements-or-components. The pattern was signed off by Artak at Blazor Binary message size send from server to client increases aspnetcore#17886 (comment) with an update later per Example update #23566.
• Create an Overview in the Fundamentals node with a bare bones explanation of a component in order to understand fundamental concepts+examples better, orient on any doc consumption features (e.g., use of working examples, sample apps, use of the this keyword, resolve Blazor common sample enhancements #14216, etc.), and any other prelim remarks before the reader gets into the meat of the coverage. Blazor docs need to be streamlined #22230 (comment) Add Blazor Fundamentals node overview #24880
• JS interop
  • Call JS from .NET doesn't demo cancellation token use with aborting a long-running JS FN. I think a working cut-'n-paste example wouldn't take up much space and would be nice to show. Issue: Show Blazor JS interop abort example #25319 PR: Abort a long-running JavaScript function #25346
  • The Call .NET from JS topic mentions but doesn't show an example of calling a generic class method ... include one? Cross-ref: InteropComponent.razor, jsinteroptests.js, and GenericType<TValue> Issue: Blazor JS interop with generic methods #25450 PR: Blazor JS interop with generic methods #25465
  • Is there anything else in the family of JS interop JS function calls that should be mentioned or explained out with examples? Cross-ref: PU Microsoft.JSInterop.ts UPDATE: Let's hold with what we have for additional community feedback and/or PU guidance on any missing scenarios, probably edge scenarios tho given that the most common scenarios should be covered now with the addition of the prior two bullet points.
• Old sample apps dropped on Blazor drop old sample apps #23228. Do we want to make the snippet sample apps into running apps and link them in the Blazor docs? Related ?: Whether or not we make snippet samples for download, should sample apps in general be kept/cross-linked in the official MS samples repo for easy download. This was a long-range plan for all ASP.NET Core sample apps AFAIK, but it hasn't taken place due to constant higher-priority work. We could at least make the Blazor Server-EF Core final app and the two Blazor-SignalR tutorial final apps available via that mechanism for easy download. Begins with Add Blazor Fundamentals node overview #24880, but I'll be performing further updates quickly to use the new dotnet/blazor-samples repo.
• WRT Static files caching behaviors, I think updates have addressed it. Blazor JS file cache/no-cache guidance #23235) Improve Blazor WASM caching/integrity guidance #24807

UE pass tracking

Only includes topics that weren't reached in '21 or new topics added in '21.

• Components - The Overview topic is getting a bit too long again. Time to look and see if we can split out content into new, smaller sub-topics in this node. This page should be broken up #27811, ASP.NET Core Razor components overview - split out Blazor Custom Elements sections #27931
  • Control <head> content
  • Dynamically-rendered components
• File downloads topic: Use fully-working examples, place code into snippet sample apps, and see the cross-linked discussion and bits mentioned in Blazor file download updates #24560 (comment).
• Call a web API from WebAssembly — Although this topic had it's UE pass in '21 on Blazor Call web API UE pass #22410, the web API aspects rely on the main doc set web API article, and churn in the web API doc can break the Blazor experience in this topic.
• Images topic: Use fully-working examples.
• Security and Identity — See 👉 Would it be too much to ask to properly explain this #20708, Explain schemes in Blazor WASM security #19807, and AzureADDefaults.JwtBearerAuthenticationScheme vs AzureADDefaults.BearerAuthenticationScheme #19226. I placed an ellipsis in the App component example INCLUDE(s) to cover 6.0 churn. See: Missing code which is generated from project template #23696. Work Add an AAD scenario: authorized client apps for APIs #25026 in this node. There are general remarks and some specific items for AAD/AAD B2C and UserManager/SignInManager at Confusing instructions, Code example cause internal Server error #27279.
  • Overview — Either here or in the Blazor Server Overview: How to refresh updated Claims without login out #22405 Make a note that for the [Authorize] attribute applied with @attribute (or in code) to a component that it automatically handles tossing an unauthenticated user to the IdP for sign in. It requires considerably less markup/code to implement than an <AuthorizeView> for the mere purpose of including a custom RedirectToLogin component in the project for the <NotAuthorized> render fragment.
  • Blazor Server — Unable to do this with Teams Toolkit #27432
    • Overview — Review, work was done on 👉 Update Blazor Server authentication topics for ASP.NET Core 5.0 #20119 and mention Miss a strategy to handle the refresh of tokens #19797 (comment).
    • Threat mitigation
    • Additional scenarios — Review, work was done on 👉 Update Blazor Server authentication topics for ASP.NET Core 5.0 #20119. Also, see 👉 Provide More Details on "Common Services" #22122. Refresh token info request: Give more info about RefreshToken  #26086.
  • Blazor WebAssembly
    • Overview — See 👉 The significance of accessTokenAcceptedVersion attribute should be mentioned #21741 (cross-link to an Azure doc from all of our AAD/B2C docs). See 👉 Two App Registrations? #20512. Also, consider surfacing a smidgen of WebAssembly "sandbox" content in a new section with a cross-link or two (e.g., https://webassembly.github.io/spec/core/intro/introduction.html#security-considerations, https://webassembly.org/docs/security/). It would be nice to clarify that WebAssembly (as a non-MS technology) is constantly undergoing security patching, and there is a place (I'll find the link) where devs can see potential security vulnerabilities, work on WebAssembly security, and patches being put into place. PR: Security Overview updates #27950
    • Standalone with Authentication library — See 👉 Blazor std-alone oidc authorization not requesting prompt #21510, Blazor standalone oidc authorization not requesting prompt aspnetcore#30068, "offline_access" scope with AddOidcAuthentication? #23712
    • Standalone with Microsoft Accounts: See This page does not describe authentication with "MS Account" #21816
    • Standalone with AAD
    • Standalone with AAD B2C — "custom user flows" language Can't log in or create account or reset password #21144. Take a look at signup-signin Azure UI per Blazor WASM AADB2C template fetchdata failed due to The issuer '(null)' is invalid aspnetcore#39401 (comment). Note to readers that B2C with Graph API isn't supported.
    • Hosted with AAD — See 👉 Question/Clarification wanted for Blazor WebAssembly Azure AD Setup Documentation #21983, Web is not the default if you create new app #26165
    • Hosted with AAD B2C — "custom user flows" language Can't log in or create account or reset password #21144; see 👉 Critical error out of the box. #21640. Take a look at signup-signin Azure UI per Blazor WASM AADB2C template fetchdata failed due to The issuer '(null)' is invalid aspnetcore#39401 (comment). Take a look at an edge case for wanting the id token in spite of the default code flow: Error retrieving the current token in a Blazor application after successful authentication in Azure B2C with Msal aspnetcore#39311 (comment) w/addl discussion at Error retrieving the current token in a Blazor application after successful authentication with Oidc client aspnetcore#41873 ... I don't think that we'll cover it, but take a look, especially if MS IdP/MSAL/Azure docs cover it and it can be cross-linked (and this assumes that we're even keeping this topic in the first place. It might get the 🔪.) Note to readers that B2C with Graph API isn't supported directly ... the host ASP.NET Core app can expose Graph API via web API calls.
    • Hosted with Identity Server — See 👉 Can't find certificate in store when deploy in production. #21842 and also see CAN'T DEPLOY BLAZOR WASM ON AZURE #22753 (Was it just VS not creating the project with the correct Identity config to run OOB when deployed to Azure directly from VS?) Consider splitting out custom domains from IdS, and check on the B1 requirement IdS-only scnearios (it might not be a requirement in that case). See 👉 Confirm hosted Blazor IdS AKV certificate access guidance #24067 (comment). If the doc doesn't already say that DP must be configured for automatic key management, make it say that and cross-link to the main doc set doc section (see: Add section about setting up the IdentityServer key in prodution #27989 (comment)).
    • Additional scenarios - Look for split-out opportunities. Possibly add an introductory ToC with section descriptions. Consider if the Unauthenticated or unauthorized web API requests in an app with a secure default client section could be better cross-linked/mentioned explicitly in the individual WASM security topics (Blazor Server Authorize Attribute #22217 and Additional HTTP client reference in note section #22220). Consider making an INCLUDE out of the prerendering guidance and shooting a copy of that into the Prerendering and Integration topic (Add Blazor hosted WASM prerendering steps when using Azure Ad authentication #23441). Check on the "outgoing HttpResponseMessage" language in the API doc, per discussion at Confusing AuthorizationMessageHandler remark #26739 (and respond back on that issue with the final answer from the PU).
    • AAD groups and roles — Update Blazor Azure Active Directory groups and roles doc for ASP.NET Core 5.0 #20856; do we need a Blazor Server pivot, or can we cross-link? See 👉 sample for Blazor Server #22422 PR: Blazor AAD groups and roles updates #27910
    • Graph API — See 👉 Several question related to this page #22657, Add a note about privilege escalation attacks using Graph permissions and public clients #27754 PR: Blazor MS Graph article updates #27875, Blazor Graph SDK/API article updates #27883, Blazor Graph code NIT #27884
  • Content Security Policy
• Debug WebAssembly — Resolve 👉 Something is missing in this instructions on how to debug a Blazor Webassembly hosted. #23373 ... and we'll probably need to show full files everywhere we refer to tasks.json/launch.json due to Errors when running .net generate assets to build .vscode folder vscode-csharp#4542. See 👉 small clarification #23777
• WebAssembly native dependencies
• Test components - Specifically, let's consider hosting example component tests for WASM and Server (TestServer). Missing example on how to use TestServer with ASP.NET 6 #25263
• Progressive Web Applications — See 👉 Blazor SPA PWA offline auth #21100
• Host and deploy: Apache for hosted WASM/sub-app scenarios might need more work. See 👉 Blazor Linux hosting #24519 (comment).
  • Overview — Perhaps for Routing, too, but clarify the navigation behavior of NavigationManager.NavigateTo. See :point-right: Use relative path in NavigateTo #22146 (comment).
  • Blazor Server — See 👉 Publishing Blazor to IIS from Visual Studio #21226
  • Blazor WebAssembly — See 👉 Revert to minified Google Brotli script in Blazor WASM hosting #19979 and Virus Detected! #21829 (comment) and validate web.config post PR Remove .wasm file extension before redefining it #24950 and in light of discussion on https://stackoverflow.com/a/69888016 and https://stackoverflow.com/a/70967738. Probably add a tagged SO filter link: https://stackoverflow.com/questions/tagged/blazor+iis+compression
  • WebAssembly deployment layout
• Blazor Server and EF Core
• External to the Blazor node: Scaffolding topic sections that pertain to Blazor — See 👉 Blazor and jwt problems with Scaffold Identity #8434 (comment)

SEPARATE WORK ITEM FOR SECURITY NODE

• Consider a topic on Azure Functions with Blazor WASM+AAD/B2C: My understanding is that it was NOT possible ... at least for B2C (perhaps AAD always worked). See Blazor Webassembly (standalone) does not work with v2.0 endpoints aspnetcore#35794 (comment). That discussion occurred back in August, 2021, so things may have improved by now for B2C/WASM/AF. IMO, this architecture makes a lot of sense for WASM serverless scenarios. 👍

UE pass tracking ('23)

New topics added in '22 (or earlier) that haven't had the 🦖 Rex Treatment™ 🦖 (or at least haven't had it for quite a long time ... years) ...

• Blazor Server and EF Core
• Multiple hosted WASM apps article
• Debug WASM article
• Call web API topic: I'd like to divorce this from the main doc set's web API article in favor of a small Minimal APIs-based web API app for the experiences in the topic. I think churn on the main doc set article may have broken the cut-'n-paste, fully working examples that I have. I either need to update the examples to match the latest guidance in the web API article or place a dedicated app example in this topic, and I favor the latter because of on-going web API article churn ... this is a fragile 💥 setup because I don't maintain both articles.
• File Uploads article
• File Downloads article
• Test article
• PWA article
• Performance best practices article
• State Management article
• Virtualization article: Blazor Virtualize Docs Are Confusing #27537
• Blazor Hybrid
  • Overview
  • Tutorials
    • Overview
    • .NET MAUI
    • Windows Forms
    • WPF
  • Routing and navigation
  • Static files
  • Dev Tools
  • Reuse components
  • Security
    • Overview
    • Security considerations

[jez9999]

Is it yet possible to compile a WASM Blazor app using AOT into pure .wasm files, with no .dll or .bin downloads? If so, is it possible to split these .wasm files into chunks much like a JS SPA app would be? I'd like Blazor to get to a stage where my app is served in several chunks (each a .wasm file with DLL code obfuscated enough to get past firewalls), where you have the chunks split up intelligently for optimal caching. For instance, one chunk could just contain commonly-used DLL code that is likely not to change, such as System.Collections.Generic. Another could contain other .NET framework dependencies for the app. Another could contain Nuget package dependencies, and another could contain the remaining app code (most likely to need regular updates).

[guardrex]

@jez9999 ... That discussion is taking place on dotnet/aspnetcore#36978. The multipart bundle guidance that we have is at ...

https://learn.microsoft.com/aspnet/core/blazor/host-and-deploy/webassembly-deployment-layout