Blazor questions answered: Security, browser support, synchronization and more

If frameworks like Angular feel like too steep of a learning curve for you to deal with, it might be time to check out Blazor. A Microsoft framework, Blazor allows you to build the same rich experiences in-browser while being fully based in C# and HTML, using a syntax that’s very similar to ASP.NET development.

We recently asked solution architect and Pluralsight author Gill Cleeren to answer several frequently asked questions developers have about using and building with Blazor. Find those answers below, and then check out Gill’s recent on-demand webinar “Building rich applications with C# using Blazor” for more.

A: It really depends on the hosting model of Blazor you are going to use. If you plan to use Blazor WebAssembly (WASM), then your browser needs to have support for WASM. That is the case for all modern browsers, including on mobile. Your Blazor WASM application will run fine on Chrome, Edge, Firefox, Safari and also on the mobile variants of these.

However, Internet Explorer doesn’t support WASM and therefore can’t run client-side Blazor apps. If this is important for your case, then you can still use Blazor server-side. In that case, the code executes on the server and then there is no client-side support required for WASM.

A: I use Xamarin for most mobile development projects, given that it offers me the ability to create native mobile apps using either Xamarin.Forms or native Xamarin. There is definitely a learning curve when going the Xamarin route, because you are building a native application. If you choose Xamarin.Forms, you’ll use XAML and C# (or just C# alone). Performance-wise, these apps are best-in-class—and since they’re native apps, they’re able to access all features of the device including sensors, storage, camera and so on.

Blazor applications are web apps and therefore execute as such, but it is possible to build a progressive web application (PWA) with Blazor. On PWAs I’ve built with Blazor, we build the application with offline support, so those features continue to work fine. In terms of leveraging knowledge, Blazor uses HTML and C#, so the learning curve is a lot smaller. Of course, being a PWA, there are limits to what the app can do on the device in terms of accessing native features. There are interesting experiments going on with Blazor development for native mobile apps using Mobile Blazor Bindings, which may prove out a future where Blazor can be used to create native mobile apps.

A: I haven’t had any issues with it yet. The app I’m currently building with Blazor is pretty large and uses a lot of features—offline data, syncing, lots of screens—and it performs really well, even on lower-end mobile devices. I’ve done a lot of Silverlight back in the day and can’t recollect any major issues with it in terms of memory or resource usage.

A: You should consider Blazor as a tool for building web applications. Web apps are heavy on client-side rendering. From that perspective, Blazor applications are the same as Angular or Vue apps: They focus on the app aspect, not so much the content aspect. For these types of applications, SEO and content discoverability aren’t all that important.

A: You would expect that server-side Blazor would need a lot of memory to run the application for all users. Turns out, that is not the case. With a regular Blazor application and a Standard D1 V2 instance in Azure (which has 3.5GB of memory available), the server could easily handle 5,000 concurrent users. Increase that to 14GB of memory and it could handle 20,000 concurrent users. You can find more information here.

A: Blazor can pass parameters via the query string, and those parameters will be captured by the target page. On the target page, you can then use the [Parameter] attribute to get access to the value. However, you can only pass simple string values through the query string.

Also keep in mind that the application is running on the client, so your different pages can access the same objects in memory. This means you can do state management, where you store data of the application and access that from any page.

A: As Blazor apps (WebAssembly) are downloaded to the client browser, they can run on the client without a connection to the backend. If you architect your application such that it can do so, it can be fully functional and work with data locally. With a little help from JavaScript, Blazor can also detect if the network connection is available. I typically create apps so that we can fall back on working locally, and once the connection is available again, the local data is synchronized to the backend. This does require some thinking upfront, since your app (while working offline) won’t be able to connect with the backend for up-to-date data.

A: Blazor runs on the client; it’s .NET code. IL code will get downloaded to the client-side, which means that it’s possible to reverse engineer. And that means that you should never put any secrets (such as passwords) in your Blazor WASM code. In order to connect with a remote database, your Blazor application would need to connect using a username-password combination, which could only be stored in the app. That would be a huge security risk, so don’t do that!

Instead, you should only be accessing remote data through a controlled access layer: a service. Create a service API (like REST, for example) around your database that exposes the operations you want to expose. On that API, you can then work with security tokens to ensure that only authorized users can access the API—and thus, your data.

A: I have more personal work experience with client-side, since that’s offered me more options for the type of applications I’ve built with it (with offline support being probably the top consideration). For other scenarios, I’m sure Blazor server-side can be a solution as well, but it really depends on what you expect from the framework. Remember that it’s possible to switch your application from one model to the other with no code changes (apart from the startup of the application). If you’re interested in learning more, I demonstrate this in my Blazor intro course.

A: Yes. You can choose to create Blazor apps using a Mac. I use Visual Studio most of the time, but VS Code can also be used to create Blazor apps. That works on Mac as well.

A: WebAssembly (and therefore Blazor as well) is running within the same security context as JavaScript, so it can only do so much on the local system. This is a good thing, otherwise this would be a security risk. That being said, Blazor doesn’t have built-in capabilities to store local data at this point. But since we can access what is available within the browser already from Blazor, we can also access Local Storage, available from JavaScript. Through JavaScript interop, we can easily store data locally using this built-in API.

A: I would say yes. I’ve been building apps with it for some time, even before it was released.

A: Angular has great features and is a fantastic framework, but it can be hard to learn, especially if you don’t have a lot of JavaScript experience. With Blazor, you can use what you already know as a .NET developer (C# and .NET Core) to build the same SPA experience for your users.

A: We have a full learning path here on Pluralsight that covers a lot of aspects of Blazor development. And as a plus, it’s already updated to support the latest WASM release from May 2020.

Want even more Blazor tips and tricks? Check out our recent intermediate-level Blazor livestream with .NET developer Jeff Fritz.