Blazor 10.0

Apply the ASP.NET Core 10.0 and C# 14 prompts first. Target net10.0 with supported .NET 10 servicing updates. These rules cover Blazor Web Apps and standalone Blazor WebAssembly, including static SSR, Interactive Server, Interactive WebAssembly, and Interactive Auto.

Render modes and trust

• Treat code, configuration, and data shipped in the .Client project or standalone WebAssembly output as browser-accessible; keep confidential code and privileged credentials in server services.
• Authorize both the server service used during SSR and the API used during client rendering of an Interactive Auto component; an API's authorization metadata doesn't protect direct server service calls.
• Keep OnInitializedAsync free of irreversible mutations: prerendering and interactive initialization can execute separately. Make explicitly requested writes safe against duplicate events, retries, and restored UI state.
• Return explicitly after NavigationManager.NavigateTo when redirecting on failed authorization or validation. .NET 10 templates set BlazorDisableThrowNavigationException to true, so static SSR can continue executing code after navigation; a redirect isn't an execution barrier.

Authentication and authorization

• Use [Authorize] on routed @page components and AuthorizeRouteView for interactive routing. Child components aren't protected by their own [Authorize] attributes; static SSR authorization runs in the ASP.NET Core pipeline.
• Enforce resource and tenant policies inside server event handlers and services before returning data or mutating it;