ASP.NET Core Roadmap for .NET 9

[danroth27]

Discussion thread on the ASP.NET Core Roadmap for .NET 9

[damienbod]

Feature request: Add support for OAUTH PAR RFC 9126

• https://datatracker.ietf.org/doc/html/rfc9126
  Existing issue here: Support for Pushed Authorization Requests in OidcHandler #51686

[damienbod]

Feature request: Add Support for OAUTH DPoP RFC 9449

• https://datatracker.ietf.org/doc/html/rfc9449

[damienbod]

Feature request: Add (back) support for CSP nonces in Blazor

• This is possible with Blazor server and Blazor WASM hosted in ASP.NET Core but not for Blazor Web

[javiercn]

@damienbod If you use it in webassembly you need to register the service in wasm, and instantiate it right after you build the webassembly host so that it gets populated with the component state from the server during the startup of the webassembly host.

[damienbod]

Thanks for your answer. I am not sure I understand you. Do you mean here?

https://github.com/damienbod/Hostedblazor8MeID/blob/dev-csp/BlazorWebMeID/BlazorWebMeID.Client/Program.cs#L07

This is my WIP of this.

[damienbod]

@javiercn I implemented this for the server mode with an example: https://damienbod.com/2024/02/19/using-a-csp-nonce-in-blazor-web/

[cheriansk]

@damienbod - but it still has usage of " .UnsafeInline()" which is a strict security violation..right? Any chance to get rid of that

[damienbod]

Hi @cheriansk. thanks for your feedback. When using UnsafeInline together with a nonce, this is the recommended way (this is only added as a fallback for older browsers.) The UnsafeInline is not recommended when not using nonces.

[sfiruch]

As @gabephudson already wrote in #51834 (comment):

I would love to see the ASP.NET session state provider work with InteractiveServer components in Blazor Web so we can share session state across RenderMode boundaries.

I think this is basic functionality that should automagically work out of the box. I was surprised to learn how complicated it is to share session state between static/interactive/wasm.

[oluatte]

#42561 is big barrier to using blazor for consumer apps and deserves a look in .NET 9.

[danroth27]

Thanks for this feedback! #42561 is high on our list of work we want to do, but it's also a large, complicated issue. To fit it in, we'd need to cut multiple issues from the existing list. So, there's a tradeoff here of either doing multiple more well-defined issue or one larger riskier issue.

[oluatte]

Appreciate the response @danroth27 and understand the balancing act prioritization can be.

This one is especially important to me because it heavily impacts the first & subsequent impressions users and developers have of Blazor...

• First impressions of users to the sites built with Blazor
• First impressions of developers considering using Blazor
• Continuing impressions of users & developers even after they're already using these sites e.g. The flicker happens after redirects to identity providers. -

It's a bummer the risk level is high for this issue (didn't realize that), but it is also true the value is high!

Thanks for listening.

[fingers10]

I would like to see the progress on #42561 and #30567 and #42284

[danroth27]

Thanks for the feedback, @fingers10! Please make sure you've already given those issues a 👍 to indicate your interest. It also helps to comment on your scenarios and why the issue is important to you.

[ajkonkol]

I'd like to see the W3CLogger get some love, as originally reported in #42489 and #35614 .

[MarkStega]

I would still like to see the issues concerning static web asset production as seen in #38445 get addressed.

Currently, the production of assets via csproj commands are fragile and very difficult to maintain. See #52673 and #44182 for example issues.

[boukenka]

I would like to see a progress for Consider shipping ObjectGraphDataAnnotationsValidator / ValidateComplexTypeAttribute.

[SbiCA]

If it turns out to be a missing feature #54051 I'd like to see this one 😄

[KennethHoff]

The roadmap issue is slowly losing a lot of entries 👀

[danroth27]

Yes, we've had to make some cuts recently to make room for additional performance work, security work, and some unexpected work needed to enable .NET WebAssembly multithreading for Blazor. Blazor on WebAssembly currently makes a bunch of single threaded assumptions that we need to clean up. Note that even with these cuts we believe the .NET WebAssembly multithreading work is now at risk for .NET 9, but we'll just have to see how it goes. We of course welcome contributions to help bring in any of the items that we ended up having to cut. Just be sure to follow our contributing guidelines and engage early with the team on the design.

[Eddie-Hartman]

Just wanted to add that better hot reload support for blazor wasm is one of the big things for our team that makes it still not feel completely "ready". That being said, we have an app in production and things have been great. However, a better hot reload experience would be a HUGE dev experience improvement. I understand some of the current limitations, but just as an example, we use Blazor WASM with MudBlazor, and when adding/removing/changing re-usable components, those changes are usually not hot-reloadable and require restarting the app.

I really like this framework, but right now this is the biggest hurdle preventing me from suggesting it broadly for apps. I still suggest it, but it's a caveat to deal with.

[ady109]

AFAIK there is currently no built-in solution in .NET Core to generate authentication tokens, see: https://developer.okta.com/blog/2018/03/23/token-authentication-aspnetcore-complete-guide#generate-tokens-for-authentication-in-aspnet-core

Are there any plans to bring this feature back in .NET 9 or future versions?

[JeremyLikness]

The Microsoft.IdentityModel.JsonWebTokens library supports creating a JWT. We do not currently have plans to add anything beyond what it supports today.

[tts-jwiebe]

I'd like to see progress on #54756. Authentication ain't trivial and should work in all flavours.

[danielchalmers]

With performance as a goal I hope to see some work around the issue of excessive component re-renderings, ex: #54543

[lnaie]

Guys, please put some time into this one: #44781 (comment)