Blazor project tracking 2026

# 2026

## For .NET 11

Per #36162, the https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-jwt-bearer-authentication?view=aspnetcore-9.0#handling-access-tokens section makes a remark about a future release having automatic token refresh with `SaveTokens` enabled.

## History

* [Blazor project tracking 2025 (dotnet/AspNetCore.Docs #34434)](https://github.com/dotnet/AspNetCore.Docs/issues/34434)
* [Blazor project tracking 2024 (dotnet/AspNetCore.Docs #31423)](https://github.com/dotnet/AspNetCore.Docs/issues/31423)
* [Blazor project tracking 2023 (dotnet/AspNetCore.Docs #28001)](https://github.com/dotnet/AspNetCore.Docs/issues/28001)
* [Blazor project tracking 2022 (dotnet/AspNetCore.Docs #24615)](https://github.com/dotnet/AspNetCore.Docs/issues/24615)
* [Blazor project tracking 2021 (dotnet/AspNetCore.Docs #19286)](https://github.com/dotnet/AspNetCore.Docs/issues/19286)

## .NET 11

* [ ] ***CHECK THIS!*** .NET 10: File Upload work: https://github.com/dotnet/AspNetCore.Docs/pull/33357, https://github.com/dotnet/aspnetcore/issues/47301

## Doc ideas

Not **ALL** of these will be worked. This is an idea list/check list that don't rise to the level of opening an issue at this time.

* [ ] "WASM" stands for "Web Assembly Modules," but I don't think we state that explicitly.
* [ ] Where we speak to "access token(s)," we need to sprinkle some "JWT"s in there to help with search results where the filter is for "JWT" in articles.
* [ ] Replace the old Swagger/NSwag testing approach with the built-in OpenAPI document generator (`AddOpenApi`/`MapOpenApi`), and uses Scalar (`Scalar.AspNetCore`) as the browser UI for VS Code instead of NSwag's Swagger UI. Visual Studio continues to use Endpoints Explorer + `.http` files.
* [ ] Dogfood the [passkeys implementation guidance for existing apps](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/passkeys/blazor?view=aspnetcore-10.0&tabs=net-cli&pivots=existing-app). There wasn't time when the content came over to do it.
* [ ] PWA notifications article possibly to have a section on how to get a cert from AKV for the public/private key bits. Rejected for work to resolve #35747 because I was too busy with high priority work for several months out.
* [ ] Per #35839, we can add a visual UI/endpoint tester for web API samples/articles.
* [ ] Blazor-related MSBuild properties and items quick reference with cross-links article?
* [ ] Published the BWA+WinAuth with the fallback policy. Halter will need to troubleshoot a recursive page loading problem after authentication, and then we can update the sample and article showing both approaches. https://github.com/dotnet/AspNetCore.Docs/pull/34708#issuecomment-2752085936
* [ ] "the entire State Management page could simply be a list of approaches with links to other pages that explain each feature in detail" https://github.com/dotnet/AspNetCore.Docs/pull/34779
* [ ] Do we want a tutorial on adding Aspire to a Blazor project? https://www.youtube.com/live/hM4ifrqF_lQ?si=BzoYljhdDLLqrRxd&t=12903
* [ ] Do we want to roll account confirmation with PW recovery and 2FA/TOTP into the WASM+Identity sample app, probably with them in a configurable state for enabling the features so that they don't break casual use of the sample without setting up an email provider. https://github.com/dotnet/AspNetCore.Docs/pull/34189#issuecomment-2536921077
* [ ] Do we want to add app roles, Azure Admin roles, and Azure security groups to our BWA+Entra article+sample? Can I just cross-link an existing BWA-Graph sample in either Graph or Identity docs? Either way, the *Application roles for apps registered with Microsoft Entra (ME-ID)* section of the BWA+OIDC article will have a cross-link or different guidance based on how this is handled.
* [ ] See https://github.com/dotnet/aspnetcore/issues/58833 for coverage in the *Security and Identity* overview and note it in prerendering coverage at https://learn.microsoft.com/en-us/aspnet/core/blazor/components/prerender?view=aspnetcore-8.0#prerendering-guidance ... and note that https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/additional-scenarios?view=aspnetcore-8.0#prerendering-with-authentication is broken (at least for the 8.0 release).
* [ ] For the BWA acct conf + PW recovery article, confirm that the wiring up of just the acct conf is enough to also activate the PW recovery part, which I don't recall if I tested or not at the time. It should just light up 💡 ... I think 🤔.
* [ ] For early 2025, get the [`FileUpload2` example (CSR)](https://learn.microsoft.com/en-us/aspnet/core/blazor/file-uploads#upload-files-to-a-server-with-client-side-rendering-csr) fully working for BWA and WASM samples. For BWA, the component is present, but there's no server controller to hit. For WASM, the component is in the WASM sample app but really should be moved to the new Call web API sample, where it can be made to work.
* [ ] Replace in-text (usually non-working) examples with `dotnet/blazor-samples`-based, fully working, cut-'n-paste examples. Might be best to create a list on an issue first, then I can work down the list.
* [ ] Apply form beautification 🌷 to the 8.0 sample app forms.
* [ ] Review *Dynamic and extensible authentication requests* for coverage opportunities https://github.com/dotnet/aspnetcore/issues/42580 https://github.com/dotnet/aspnetcore/pull/42692
* [ ] To show and explain anti-request forgery in the *File Uploads* topic, use some commented-out text held there to enable controller services with `AddControllersAndViews` ***and*** pass the anti-forgery token to the Blazor app (<8.0) or obtain it from the anti-forgery feature (>=8.0) for the POST.
* [ ] Root-level cascading values followup items: https://github.com/dotnet/AspNetCore.Docs/pull/30095
* [ ] Custom ICU creation for WASM didn't make the cut for 8.0 or 9.0. It's scheduled for 10.0 now. https://github.com/dotnet/runtime/issues/82908
* [ ] I wasn't able to resolve #29448 with #29449 because I can't see how the implementation should be applied in the reader's example app to avoid the reported behavior. Will circle around to this subject with Javier after .NET 8 releases.
* [ ] [Revert content](https://github.com/dotnet/AspNetCore.Docs/pull/29130) ([Live content](https://learn.microsoft.com/en-us/aspnet/core/blazor/host-and-deploy/webassembly?view=aspnetcore-7.0#azure-static-web-apps)) to a cross-link when [Azure Static Web Apps docs](https://learn.microsoft.com/en-us/azure/static-web-apps/deploy-blazor) get a tutorial/tooling guidance for the new publish from VS gesture. Tracking on Azure docs issue: https://github.com/MicrosoftDocs/azure-docs/issues/112013 **UPDATE (9/25/24)**: DR said he'd follow up with them because they closed the issue as a won't-fix.
* [ ] Although I'm working the *Security* node passes in February/March, I'm going to handle one item separately after the passes are finished pertaining to handling refresh tokens from Razor components when a request fails (e.g., https://github.com/dotnet/AspNetCore.Docs/issues/26086). Javier said, "... it involves sending a request to the token endpoint of the OIDC/OAuth provider in the same way you do in a web application." The refresh token is available to components via `TokenProvider` in the current guidance, so it seems that the component calls a server API to hit up the IdP to renew (and get a new refresh token) with an update to the `TokenProvider` with the new tokens. The component continues processing transparently (re-initiates the web API call that it was making in the first place) after the server-side work. Cross-refs: https://github.com/dotnet/AspNetCore.Docs/issues/19797#issuecomment-779294104
* Especially: https://github.com/dotnet/AspNetCore.Docs/issues/22405#issuecomment-849106466
* ... and because it was never built-into the scaffolder to change the default logout page for Blazor Server: https://github.com/dotnet/Scaffolding/issues/1423 ... ***OR, alternatively*** ...
* XSRF antiforgery token content exists and the component can pass it to the endpoint because I don't think we want to tell devs to decorate server-side endpoints with `@attribute [IgnoreAntiforgeryToken]`, including for logout. The coverage is at: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/scaffold-identity?view=aspnetcore-7.0&tabs=visual-studio#pass-an-xsrf-token-to-the-app
* [ ] Per Steve's .NET Conf talk, shouldn't we briefly cover [`FileSystem` API](https://developer.mozilla.org/en-US/docs/Web/API/FileSystem) use in Blazor apps?
* [ ] Let's run through the [`testassets` pieces in the framework](https://github.com/dotnet/aspnetcore/tree/main/src/Components/test/testassets) to see what might be helpful for devs to see in docs. It's a large task tho because there's so much there. This probably can't be worked in 23H1, possibly for 23Q3 tho.
* [ ] Do we want a cascading param state management example? https://learn.microsoft.com/en-us/aspnet/core/blazor/state-management?view=aspnetcore-6.0&pivots=webassembly#additional-approaches-wasm https://github.com/dotnet/AspNetCore.Docs/issues/27296
* [ ] Best to have PU 🐈 look over the SignalR-Blazor enhancements for SignalR config (in the SignalR doc and the WASM/Server Host and Deploy docs) and SignalR client logging (in the Logging doc).
* [ ] Place element attributes in alphabetical order.
* [ ] The section https://learn.microsoft.com/en-us/aspnet/core/blazor/fundamentals/signalr?view=aspnetcore-9.0#websocket-compression-for-interactive-server-components wasn't reviewed ... no one was available to look.
* [ ] [Confirm language](https://learn.microsoft.com/en-us/aspnet/core/blazor/components/render-modes?view=aspnetcore-8.0#interactive-server-side-rendering-interactive-ssr) on interactive SSR components in the `Pages` folder of the `.Client` project. Removed on https://github.com/dotnet/AspNetCore.Docs/pull/34050 per DR's request. A PU issue where Javier says that it's correct: https://github.com/dotnet/aspnetcore/issues/58944#issuecomment-2479063422
* [ ] Put an :eye: on one line in particular in the [prerendering with JS interop](https://learn.microsoft.com/en-us/aspnet/core/blazor/components/lifecycle?view=aspnetcore-8.0#prerendering-with-javascript-interop) INCLUDE file: *An infinite loop isn't created because `StateHasChanged` is only called when `scrollPosition` is `null`.*
* [ ] Review of the new section on custom input components at https://learn.microsoft.com/en-us/aspnet/core/blazor/forms/binding?view=aspnetcore-8.0#custom-input-components.
* [ ] Review of https://learn.microsoft.com/en-us/aspnet/core/blazor/images-and-documents
* [ ] Confirm `addHandlers` module FN approach for wiring up event handlers.
* [ ] When he's free, check on the param expression bit added by #32511.
* [ ] The framework does what we say devs aren't supposed to do on transient disposables for `IHttpClientFactory`/`HttpClient`.
* [ ] Review of the new example at [*Fundamentals* > *DI* > *Utility base component classes to manage a DI scope* section](https://docs.microsoft.com/aspnet/core/blazor/fundamentals/dependency-injection#utility-base-component-classes-to-manage-a-di-scope).
* [ ] The **_WHY_** aspects on https://github.com/dotnet/AspNetCore.Docs/pull/26620#issuecomment-1205513721. I'd like to know why the RID works with the MSBuild prop (`/p:RuntimeIdentifier={RID}` but the self-contained setting doesn't (`/p:SelfContained=false`).
* [ ] Review the code for streaming `` content in a form of #29541. [Live](https://learn.microsoft.com/en-us/aspnet/core/blazor/forms-and-input-components#large-form-payloads-and-the-signalr-message-size-limit)
* [ ] Ask about https://docs.microsoft.com/en-us/aspnet/core/blazor/components/dynamiccomponent?view=aspnetcore-6.0 per https://github.com/dotnet/AspNetCore.Docs/pull/26557. Is this the best way to showcase event callbacks with dynamic components?
* [ ] In `UserClaims` components (and perhaps a few other spots) the code for a collection displayed in the UI can can have the collection be assigned an empty value or left nullable with an additional Razor nullable check. Which is best? There's a text file on the desktop with the code either way.
* [ ] Do we need to assess all Blazor examples where tasks are awaited looking for spots where it would be more appropriate to avoid resuming with the context (`ConfigureAwait(false)`)?

## Resolved

* [x] `[PersistentState]` must be a public property: https://github.com/dotnet/aspnetcore/issues/63329#issuecomment-3199870419 - *Done!* on #37003
* [x] Overhaul tracking ideas from Wade: https://github.com/dotnet/AspNetCore.Docs/pull/36326#issuecomment-3517676538 - *Rejected!* ... because there's no consensus on how to do it.
* [x] Current user coverage: https://github.com/dotnet/aspnetcore/issues/55327#issue-2260216946 - Already covered [here](https://learn.microsoft.com/aspnet/core/blazor/security/?tabs=visual-studio#obtain-a-users-claims-principal-data).
* [x] I think there are a couple of uses of "repo." I'm probably going to change them to "repository," which is the usual word of choice for GitHub repos. - *Done!* on #37006.
* [x] Where "[`{PACKAGE}`]({LINK}) package" is used, move "package" into the link text. - Resolved by #37008.
* [x] https://github.com/natemcmaster/dotnet-serve is useful for quick, local runs of a published Blazor WASM app. Consider covering it in the Host & Deploy WASM overview. It might just be an 'additional resource.' - Resolved by #37010.
* [x] WRT https://github.com/dotnet/AspNetCore.Docs/pull/35988, take a look at customization of paths guidance because it isn't only about the login path. When other paths are hard-coded into the app (template), they either have to be changed to match what's going to be used or `RemoteAuthenticationOptions` should be used to obtain them. - Resolved by #37012.
* [x] What about moving the *Razor syntax* article out of the MVC views folder? - Resolved by an earlier PR.
* [x] Do we need more coverage on Azure Static Web Apps and Blazor deployments? https://learn.microsoft.com/en-us/aspnet/core/blazor/host-and-deploy/webassembly?view=aspnetcore-9.0#azure-static-web-apps - Resolved by earlier PRs. [Live article](https://learn.microsoft.com/en-us/aspnet/core/blazor/host-and-deploy/webassembly/azure-static-web-apps?view=aspnetcore-10.0)
* [x] With `<NotFound>` going away for BWA at 8.0, I think a dedicated bit in the *Error handling* topic on processing 404s via built-in server middleware makes sense (i.e., `UseStatusCodePagesWithRedirects`). Resolved by #37017 with a cross-link to the Not Found coverage in the *Nav* article.
* [x] It would probably be nice to create a `QuickGrid` example that opens and closes a detail record component without losing the page and scroll position of the grid. For context, see https://github.com/dotnet/blazor-samples/issues/58. - Resolved by #37020.
* [] xxx

## PU review items

Steve:

* [ ] API of last paragraph in https://learn.microsoft.com/en-us/aspnet/core/blazor/components/render-components-outside-of-aspnetcore?view=aspnetcore-8.0.

Halter:

* [ ] Halter to review [this section](https://learn.microsoft.com/en-us/aspnet/core/blazor/security/server/?view=aspnetcore-8.0&tabs=visual-studio#authentication-state-management-at-sign-out).
* [ ] Confirm scope and authority guidance in the BWA+OIDC article that was added on 3/26 on #32149.
* [ ] The following went in without review because they sat for weeks without response and without answers to email requests for review:
* https://learn.microsoft.com/en-us/aspnet/core/blazor/security/blazor-web-app-with-entra?view=aspnetcore-9.0#azure-key-vault
* https://learn.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/standalone-with-identity/account-confirmation-and-password-recovery?view=aspnetcore-9.0

Javier:

* [ ] Ask Javier about https://github.com/dotnet/aspnetcore/blob/main/src/Components/test/testassets/BasicTestApp/MarkupBlockComponent.razor#L37C21-L37C37 because we say in the *Threat Mitigation* topic not to use `builder.AddMarkupContent(0, someUserSuppliedString)` because it can create an XSS vulnerability.

## UE pass tracking

- [ ] *Security and Identity* - The node (overview at least) has become messy. Time for a UE pass! Cross-ref: https://github.com/dotnet/AspNetCore.Docs/issues/34743#issuecomment-2666851195
- [ ] Debug WebAssembly — Resolve :point_right: #23373 ... and we'll probably need to show full files everywhere we refer to `tasks.json`/`launch.json` due to https://github.com/OmniSharp/omnisharp-vscode/issues/4542. See :point_right: https://github.com/dotnet/AspNetCore.Docs/issues/23777
- [ ] Test components - Specifically, let's consider hosting example component tests for WASM and Server (`TestServer`). https://github.com/dotnet/AspNetCore.Docs/issues/25263
- [ ] Host and deploy: Apache for hosted WASM/sub-app scenarios might need more work. See 👉 https://github.com/dotnet/AspNetCore.Docs/pull/24519#issuecomment-1008480134.
- [ ] Overview — Perhaps for *Routing*, too, but clarify the navigation behavior of `NavigationManager.NavigateTo`. See :point_right: https://github.com/dotnet/AspNetCore.Docs/pull/22146#issuecomment-827802596.
- [ ] Move overview *App base path* coverage into its own article.
- [ ] Break out sections into articles in two primary nodes (folders) for server-side Blazor and Blazor WebAssembly. Feedback in this vein: #35047
- [ ] Blazor Server — See :point_right: https://github.com/dotnet/AspNetCore.Docs/issues/21226
- [ ] Blazor WebAssembly — See :point_right: https://github.com/dotnet/AspNetCore.Docs/issues/19979 and https://github.com/dotnet/AspNetCore.Docs/issues/21829#issuecomment-803192673 and validate `web.config` post PR https://github.com/dotnet/AspNetCore.Docs/pull/24950 and in light of discussion on https://stackoverflow.com/a/69888016 and https://stackoverflow.com/a/70967738. Probably add a tagged SO filter link: `https://stackoverflow.com/questions/tagged/blazor+iis+compression`
- [ ] WebAssembly deployment layout

Other articles that could benefit from the 🦖 **Rex Treatment**™ 🦖 ...

* Blazor Server and EF Core
* Call web API topic: I'd like to divorce this from the main doc set's web API article in favor of a small Minimal APIs-based web API app for the experiences in the topic. I think churn on the main doc set article may have broken the cut-'n-paste, fully working examples that I have. I either need to update the examples to match the latest guidance in the web API article or place a dedicated app example in this topic, and I favor the latter because of on-going web API article churn ... this is a fragile 💥 setup because I don't maintain both articles. Need to analyze the coverage on calling a web API securely to see if the *Call web API* article should have more information on it (or even just cross-links) and see if more work needs to be done in the *Security and Identity* node, especially the *Additional scenarios* article.
* File Uploads article
* File Downloads article
* Test article
* PWA article
* Performance best practices article
* State Management article
* Virtualization article: https://github.com/dotnet/AspNetCore.Docs/issues/27537
* Blazor Hybrid
* Overview
* Tutorials
* Overview
* .NET MAUI
* Windows Forms
* WPF
* Routing and navigation
* Static files
* Dev Tools
* Reuse components
* New articles at 8.0 ...
* ASP.NET Core Razor class libraries (RCLs) with static server-side rendering (static SSR)
* Integrate ASP.NET Core Razor components into ASP.NET Core apps
* Prerender ASP.NET Core Razor components
* Render Razor components outside of ASP.NET Core
* ASP.NET Core Blazor render modes
* ASP.NET Core Blazor sections
* Troubleshoot ASP.NET Core Blazor Hybrid
* ASP.NET Core Blazor JavaScript with static server-side rendering (static SSR)
* Threat mitigation guidance for ASP.NET Core Blazor static server-side rendering
* Secure ASP.NET Core Blazor WebAssembly with ASP.NET Core Identity

<!--

🚧 **In Progress on XXXXXXXXXXXX** 👷

-->