Search code examples
blazor-server-side

Is Blazor server side bind-value secure?

Can I bind entity model values in Blazor server side directly and secure? I'm starting worried, that client can in some way (with some tool) edit the communication message and set for example not "Age" but "Role" value in example below.

binding message

I see that there is some {"componentId":11, "fieldValue":88} in message, so maybe some other modified number for example {"componentId":12, "fieldValue":88} will set not "Age" but "Role"?

Solution

  • It seems that it's secure:

    Server only receives an event with data when you register an event or bind to a value. That event is mapped to the delegate that gets registered in @onchange or @bind, so it can't change any other value.

    A client could try to dispatch a random event to the server, but that will simply result in the payload being ignored (and I believe this is the case, the circuit terminating)

    In general, the client can't make any change that the server is not explicitly allowing by defining specific event handlers.

    In my experience, SSR Blazor properties are updated in ValueChanged delegates (This delegate is automatically created if you do a @bind-x or set an @onchange, @oninput, @onclick or any other event handler on an Html element ), so if no such delegate exist I can't see how that property can be updated from client code.

    Answers from: https://github.com/dotnet/aspnetcore/issues/60159

    If somebody has some other opinion - please discuss in comments.