title: What is the valid procedure to secure blazor client side app?
body: <p>I am trying to secure my blazor client-side app and have followed instructions from here
  <a href="https://docs.microsoft.com/en-us/aspnet/core/security/blazor/?view=aspnetcore-3.0&amp;tabs=visual-studio" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/blazor/?view=aspnetcore-3.0&amp;tabs=visual-studio</a></p>
  
  <p>What confuses me is this section</p>
  
  <pre><code>public override Task&lt;AuthenticationState&gt; GetAuthenticationStateAsync()
          {
              var identity = new ClaimsIdentity(new[]
              {
                  new Claim(ClaimTypes.Name, "mrfibuli"),
              }, "Fake authentication type");
  
              var user = new ClaimsPrincipal(identity);
  
              return Task.FromResult(new AuthenticationState(user));
          }
  </code></pre>
  
  <p>Since authorization is only used to determine which UI options to show and client-side checks can be modified or bypassed by a user a Blazor WebAssembly app can't enforce authorization access rules.</p>
  
  <p>So if I got it right, this is the valid procedure</p>
  
  <ul>
  <li>user sends credentials via page/form</li>
  <li>api returns a token</li>
  <li>token is stored locally</li>
  <li>reverse mechanism is implemented in GetAuthenticationStateAsync where a token is exchanged for user info</li>
  </ul>