Blazor 8.0

Apply the ASP.NET Core 8.0 and C# 12 prompts first. Target net8.0 and the .NET 8 Blazor APIs. These rules cover Blazor Web App render modes, server circuits, WebAssembly clients, static SSR forms, persisted state, interop, uploads, and hosting.

Render modes and trust boundaries

• Enable only the required interactive services and render modes through AddRazorComponents, AddInteractiveServerComponents, AddInteractiveWebAssemblyComponents, and the corresponding MapRazorComponents render-mode extensions; review the effective @rendermode inherited by descendants.
• Treat InteractiveAuto components as browser code even when they initially execute on the server; Auto can choose WebAssembly on later visits, so both implementations must enforce the same server data-access policies.
• Keep secrets and privileged implementation code outside the .Client project and its dependencies; downloaded assemblies, wwwroot configuration, and embedded resources are readable and modifiable by the user.
• Minimize parameters crossing a static-to-interactive boundary: WebAssembly and Auto parameter payloads are browser-readable, while Interactive Server descriptors use Data Protection. Neither encryption nor prerender: false protects data that the component renders into HTML or later sends to the browser.
• Use the cascading HttpContext during static SSR for request-bound work; obtain interactive server identity from AuthenticationStateProvider. Do not authorize through a captured HttpContext or IHttpContextAccessor, which can be absent or retain a stale principal