Role-Based Access Control in Blazor WebAssembly with Azure AD (opens in new tab)

Blazor WebAssembly runs entirely in the browser. That single fact shapes everything about how you implement authorization, because nothing the client decides can be trusted. A user can open dev tools, edit memory, and flip any boolean you use to hide a button. So role-based access control in a WASM app is really two separate jobs: Cosmetic — show users only the parts of the UI they're allowed to use, so the app feels coherent. Enforced — make sure the API rejects anything a user shouldn't be ...