BFF using the new Blazor Web App?

[Schoof-T]

Thanks for the amazing template! It works really well.

I'm wondering if you could make this work with the new Blazor Web App template and it's 'Auto' mode?
I've been trying but not succeeding.

[damienbod]

Thanks @Schoof-T

I was planning on trying to get this to work in Jan. Looks like there are a few issues to get this to work.

Greetings Damien

[damienbod]

Blazor Web with web assembly does not support CSP nonces and the CSRF protection with API calls needs implementation.

Switching to Blazor Web and web assembly mode is less secure

[Schoof-T]

Wow, that's a shame! Seems like a pretty big oversight from Microsoft then?

[damienbod]

Will probably support this at some stage.

[VictorioBerra]

@damienbod I am running the new Blazor Web App model, I have not been able to get CSP nonces working.

Regarding CSRF I am using Fast Endpoints and using this: https://fast-endpoints.com/docs/security#csrf-protection-for-form-submissions-antiforgery-tokens

I would love to see CSP nonces working though, Microsoft added <AntiforgeryToken /> to replace @Html.AntiForgeryToken() its a shame we do not have <LinkNonce href="lib/bootstrap.css" /> or something similar.