ASP.NET Core Roadmap for .NET 9

[danroth27]

Discussion thread on the ASP.NET Core Roadmap for .NET 9

[damienbod]

Feature request: Add support for OAUTH PAR RFC 9126

• https://datatracker.ietf.org/doc/html/rfc9126
  Existing issue here: Support for Pushed Authorization Requests in OidcHandler #51686

[damienbod]

Feature request: Add Support for OAUTH DPoP RFC 9449

• https://datatracker.ietf.org/doc/html/rfc9449

[damienbod]

Feature request: Add (back) support for CSP nonces in Blazor

• This is possible with Blazor server and Blazor WASM hosted in ASP.NET Core but not for Blazor Web

[javiercn]

@damienbod If you use it in webassembly you need to register the service in wasm, and instantiate it right after you build the webassembly host so that it gets populated with the component state from the server during the startup of the webassembly host.

[damienbod]

Thanks for your answer. I am not sure I understand you. Do you mean here?

https://github.com/damienbod/Hostedblazor8MeID/blob/dev-csp/BlazorWebMeID/BlazorWebMeID.Client/Program.cs#L07

This is my WIP of this.

[damienbod]

@javiercn I implemented this for the server mode with an example: https://damienbod.com/2024/02/19/using-a-csp-nonce-in-blazor-web/

[cheriansk]

@damienbod - but it still has usage of " .UnsafeInline()" which is a strict security violation..right? Any chance to get rid of that

[damienbod]

Hi @cheriansk. thanks for your feedback. When using UnsafeInline together with a nonce, this is the recommended way (this is only added as a fallback for older browsers.) The UnsafeInline is not recommended when not using nonces.

[sfiruch]

As @gabephudson already wrote in #51834 (comment):

I would love to see the ASP.NET session state provider work with InteractiveServer components in Blazor Web so we can share session state across RenderMode boundaries.

I think this is basic functionality that should automagically work out of the box. I was surprised to learn how complicated it is to share session state between static/interactive/wasm.

[oluatte]

#42561 is big barrier to using blazor for consumer apps and deserves a look in .NET 9.

[danroth27]

Thanks for this feedback! #42561 is high on our list of work we want to do, but it's also a large, complicated issue. To fit it in, we'd need to cut multiple issues from the existing list. So, there's a tradeoff here of either doing multiple more well-defined issue or one larger riskier issue.

[oluatte]

Appreciate the response @danroth27 and understand the balancing act prioritization can be.

This one is especially important to me because it heavily impacts the first & subsequent impressions users and developers have of Blazor...

• First impressions of users to the sites built with Blazor
• First impressions of developers considering using Blazor
• Continuing impressions of users & developers even after they're already using these sites e.g. The flicker happens after redirects to identity providers. -

It's a bummer the risk level is high for this issue (didn't realize that), but it is also true the value is high!

Thanks for listening.

[fingers10]

I would like to see the progress on #42561 and #30567 and #42284

[danroth27]

Thanks for the feedback, @fingers10! Please make sure you've already given those issues a 👍 to indicate your interest. It also helps to comment on your scenarios and why the issue is important to you.

[ajkonkol]

I'd like to see the W3CLogger get some love, as originally reported in #42489 and #35614 .

[MarkStega]

I would still like to see the issues concerning static web asset production as seen in #38445 get addressed.

Currently, the production of assets via csproj commands are fragile and very difficult to maintain. See #52673 and #44182 for example issues.

[boukenka]

I would like to see a progress for Consider shipping ObjectGraphDataAnnotationsValidator / ValidateComplexTypeAttribute.

[SbiCA]

If it turns out to be a missing feature #54051 I'd like to see this one 😄

[KennethHoff]

The roadmap issue is slowly losing a lot of entries 👀

[danroth27]

Yes, we've had to make some cuts recently to make room for additional performance work, security work, and some unexpected work needed to enable .NET WebAssembly multithreading for Blazor. Blazor on WebAssembly currently makes a bunch of single threaded assumptions that we need to clean up. Note that even with these cuts we believe the .NET WebAssembly multithreading work is now at risk for .NET 9, but we'll just have to see how it goes. We of course welcome contributions to help bring in any of the items that we ended up having to cut. Just be sure to follow our contributing guidelines and engage early with the team on the design.

[Eddie-Hartman]

Just wanted to add that better hot reload support for blazor wasm is one of the big things for our team that makes it still not feel completely "ready". That being said, we have an app in production and things have been great. However, a better hot reload experience would be a HUGE dev experience improvement. I understand some of the current limitations, but just as an example, we use Blazor WASM with MudBlazor, and when adding/removing/changing re-usable components, those changes are usually not hot-reloadable and require restarting the app.

I really like this framework, but right now this is the biggest hurdle preventing me from suggesting it broadly for apps. I still suggest it, but it's a caveat to deal with.

[MarshalOfficial]

using native AOT without custom JSON serialization pain would be a great feature.

[ady109]

AFAIK there is currently no built-in solution in .NET Core to generate authentication tokens, see: https://developer.okta.com/blog/2018/03/23/token-authentication-aspnetcore-complete-guide#generate-tokens-for-authentication-in-aspnet-core

Are there any plans to bring this feature back in .NET 9 or future versions?

[JeremyLikness]

The Microsoft.IdentityModel.JsonWebTokens library supports creating a JWT. We do not currently have plans to add anything beyond what it supports today.

[tts-jwiebe]

I'd like to see progress on #54756. Authentication ain't trivial and should work in all flavours.

[danielchalmers]

With performance as a goal I hope to see some work around the issue of excessive component re-renderings, ex: #54543

[lnaie]

Guys, please put some time into this one: #44781 (comment)

[gabephudson]

I think adding a Blazor InputHidden component would be useful for model binding (especially with SSR) and consistent with the other input components (InputText, InputSelect, etc). I was surprised this didn't already exist.

#55720

[DontEatRice]

Would love to see this one fixed - #47301 Right now working with multiple files upload in Blazor server-side is a huge pain

[gabephudson]

I know ASP.NET 9 is probably finalized, but not sure where to post this. @danroth27, for 10, I would love to see Blazor SSR to (optionally) support events. IE, the new Blazor SSR is great (very much like an improved MVC), but it's not quite complete. Would love to see it just naturally support Blazor events (like onclick). Think Blazor global interactive server without a WebSocket, but instead limited focused events and state transfer via HTTPRequest.

I was made aware (via the video below) of a very interesting open-source project called Hydro that does this with Razor Pages. It would be amazing if this type of functionality could be supported on Blazor SSR. It would be more limited than Interactive Server, but also be a sweet spot for scalability and dev productivity.

Bottom line, just want to expose the Blazor team to this project/idea, and see if in 10, we could get something similar baked in!
https://www.youtube.com/watch?v=CwZjQJHwHbQ
https://github.com/hydrostack/hydro/

[KennethHoff]

It would be very nice if SSR added support for what effectively is htmx, without the roundabout way of using htmx with Blazor ( which is fine, for reference).

This would be a direct equivalent to React's Server Actions, which are incredible.

Blazor InteractiveServer is overkill for most scenarios, with too many issues with disconnect and reconnecting that everytime I try using it I always just fall back to Blazor SSR with htmx as the superior choice (despite having a lot of footguns around state).

[danroth27]

Thanks for this suggestion, @gabephudson! If you haven't already, could you please open a GitHub issue with this suggestion so that we can track it on our backlog and the community can react to it?

[gabephudson]

Thank you @danroth27. Issue created...
#56104

[mrlife]

Hi, I remember seeing something about this, though I don't remember if it was a blog post, GitHub issue, or GitHub issue comment. The concept of sub-apps of different kinds (different Blazor render modes, Razor Pages, MVC) within one ASP.NET Core project would be a wonderful addition.

We have lots of smaller apps that we include in one domain, e.g. example.com/app1, and updating all of them when monthly security updates arrive is never a fun task. If they could exist within one project, that would make keeping them updated, and the web server configuration, much easier.

Does this concept exist in any form as far as .NET 9 or a future release?

[htmlsplash]

Will the Paginator component support paging when using Static SSR render mode in .net 9? I know there was a proposal for this, is this done?

Original issue:
#51249

[danroth27]

@htmlsplash Unfortunately, no, we ended up having to push out the work to update the Paginator component from the .NET 9 release to make room for some fundamentals & quality work. We'll reevaluated updating the Paginator for .NET 10.

[htmlsplash]

Okay. Are there any alternative solutions to paginator? I know there's virtualization but our customers are accustomed to paging for search results. I would like to use Static SSR for our search result pages because they are not interactive.

[danroth27]

@htmlsplash You can try rendering a set of page links that put the page number in the query string, and then read the incoming page number to prepopulate the PaginationState. @SteveSandersonMS started work a while back on adding this to QuickGrid here, which you can reference: #51217.

[htmlsplash]

Thanks for the suggestion. I went ahead and created my custom Paginator for Static SSR based on work Steve did. The paginator works great with Query string but the suggested solution is poor and incomplete. The problem is that each pagination request is "get" request which causes all the state on the form user entered (ie form data) to disappear.

I understand that I have to manually restore that state myself in this scenario, but this requires more and more boiler code. It doesn't seem so appealing to use Blazor Static SSR if I have to keep writing more and more boiler plate code to make basic things work.

My recommendation:
If you are introducing a feature such as using QuickGrid in Static SSR pages, you need to make it practical enough and have it work with pagination and retain form state across paging. That's the practical use case everyone will be looking for before they can use static server side rendering pages for their searches.
TLDR:
We need a complete solution for the common use case. We need solutions for common problems.

[htmlsplash]

Dan, I have found a quick fix for the problem of losing text in form fields during enhanced navigation by using "data-permanent" attribute on the input form. I am thinking if I will not be using enhanced navigation, this will cause full page refresh and and my data on the form will be lost.

UPDATE:
Yeap, turning off enhanced navigation globally and using my custom pager on Static SSR page will cause the form data to be cleared each time you page.

[RezaRahmatzadeh]

I recommend enhancing Blazor with more native and simplified support for working with map providers. Currently, it is extremely challenging to interactively work with maps in Blazor. Features such as adding points, drawing lines, showing routes, and other functionalities provided by map services like Bing or Google are far easier to implement in JavaScript frameworks. Integrating these capabilities more seamlessly into Blazor would significantly improve the development experience.

[Atulin]

I've been reading about the new static assets handling (.MapStaticAssets()) a little, and I wonder if I will be able to replace .UseStaticFiles() with it. I wasn't able to find the following information:

1. Can it be configured to handle non-default file types? For example, I currently have a mapping for .avif files to image/avif MIME type. I could not find any docs about whether it will be necessary and/or possible to do.
2. Custom compression algorithms. I currently use an implementation of ZStandard compression, followed by Brotli and GZip, should the browser not support zstd. From what I can tell, the build-time compression will only produce the latter two. Will I be able to add zstd support? Or, if not, is it planned?

[javiercn]

It's possible to configure additional content types.
It should also be possible to extend the system to support additional compression models, although a few tweaks might be needed. Supporting other compression models like zstd, specially with shared dictionaries is on our minds.

[Atulin]

Nice, glad to hear that! Looking at the docs it really seemed like .MapStaticAssets() will be very rigid, and any sort of flexibility will be provided only by .UseStaticFiles().

[javiercn]

@Atulin map static assets is build/publish time resolution vs runtime (which allows us to do more expensive optimizations) but in the end, MapStaticAssets defines a set of endpoints that you can then tweak however you see fit.

[sardar97]

Feature request :
I love blazor , I use blazor in production. but I really love to see this feature in blazor which is my dream. and I think it is dream for most of blazor developers.
the feature is Server-driven, client-rendered applications. just like HYBRIDLY .
I don't why using signalR for blazor server side (interactive server) face reconnect issue!!!. while react and JMIX(with Vadding and Hilla) will not facing any of those issues when they are server side as well and has same functionality like blazor.
for example with blazor 8 (interactive server) if I open another tab or just open another app like notepad after a few minute I can see
the reconnecting message :( which Is very bad user experience IMO. And the biggest issue is blazor (interactive server) on mobile
if I don't have interactivity just for a few seconds then I will see the reconnecting message.
I hope blazor team care more about this issue because when I compare blazor to others I get disappointed.

[Johnhersh]

I agree with this. The SignalR thing is just no good for the reasons you say here.

If it worked with requests in an RPC way, and if you could do simple client-side things without a server round-trip, it would be amazing. Right now it's a very hard sell on any of my projects.