Identity in Blazor

The AuthenticationStateProvider is the core service that tells Blazor who the current user is and what they are allowed to do.

1. How it works

It's a built-in service that returns an AuthenticationState object containing a ClaimsPrincipal. Components use the <AuthorizeView> tag to show or hide content based on this state. If the user is logged in, they see one thing; if they are anonymous, they see another.

2. Custom Implementation

For custom security (like using a manual JWT storage), you must inherit from AuthenticationStateProvider and override GetAuthenticationStateAsync. You'll likely read a token from LocalStorage, parse its claims, and notify the app whenever the user logs in or out using NotifyAuthenticationStateChanged.

3. Architect Insight

Q: "Should I trust the client-side AuthenticationState?"

Architect Answer: "ABSOLUTELY NOT. Client-side security is just for UI 'Convenience' (hiding buttons). Never use it to protect sensitive data or actions. You MUST always re-verify the user's identity and permissions on the **Server-side API** for every single request. The client-side state is a lie; the token is the truth."