Sign in to track progress and bookmarks.
The AuthenticationStateProvider is the core service that tells Blazor who the current user is and what they are allowed to do.
It's a built-in service that returns an AuthenticationState object containing a ClaimsPrincipal. Components use the <AuthorizeView> tag to show or hide content based on this state. If the user is logged in, they see one thing; if they are anonymous, they see another.
For custom security (like using a manual JWT storage), you must inherit from AuthenticationStateProvider and override GetAuthenticationStateAsync. You'll likely read a token from LocalStorage, parse its claims, and notify the app whenever the user logs in or out using NotifyAuthenticationStateChanged.
Q: "Should I trust the client-side AuthenticationState?"
Architect Answer: "ABSOLUTELY NOT. Client-side security is just for UI 'Convenience' (hiding buttons). Never use it to protect sensitive data or actions. You MUST always re-verify the user's identity and permissions on the **Server-side API** for every single request. The client-side state is a lie; the token is the truth."
Quizzes linked to this course—pass to earn certificates.
On this page
1. How it works 2. Custom Implementation 3. Architect Insight