Blazor WASM supports authentication through standard ASP.NET Core mechanisms. The most common approach is JWT bearer tokens paired with a custom AuthenticationStateProvider.

Core Concepts

• AuthenticationStateProvider — provides the current user's auth state to components
• AuthorizeView — renders content conditionally based on auth state
• CascadingAuthenticationState — provides auth state to the whole component tree

AuthorizeView in Templates

<AuthorizeView>
    <Authorized>
        <p>Welcome, @context.User.Identity?.Name!</p>
    </Authorized>
    <NotAuthorized>
        <a href="/login">Please log in</a>
    </NotAuthorized>
</AuthorizeView>

Protecting a Page

@page "/admin"
@attribute [Authorize(Roles = "Admin")]

<h1>Admin Panel</h1>

Critical Rule

Never trust client-side auth alone. Always validate authorization on the server API. Browser-side checks are UX only — they can be bypassed.

Reference:

Wikipedia: JSON Web Token

https://en.wikipedia.org/wiki/JSON_Web_Token