Skip to content

Conversation

@ilonatommy
Copy link
Member

Fix antiforgery token trimming in Blazor WebAssembly prerendering

Add DynamicDependency attributes to prevent IL trimming of antiforgery type.

Description

When a Blazor WebAssembly app with Individual Identity authentication is published with PublishTrimmed=true, the antiforgery token persisted during SSR is not restored during the SSR-to-WASM handoff. This causes the <AntiforgeryToken> component to render nothing in interactive mode, breaking form submissions.

Root cause: The IL trimmer removes DefaultAntiforgeryStateProvider.CurrentToken property and AntiforgeryRequestToken constructor because they're only accessed via reflection by the persistent state system.

Fix: Add [DynamicDependency(JsonSerialized, typeof(...))] attributes on WebAssemblyHostBuilder.InitializeDefaultServices() to preserve:

  • DefaultAntiforgeryStateProvider - ensures the [PersistentState] CurrentToken property is preserved
  • AntiforgeryRequestToken - ensures the constructor and properties are preserved for JSON deserialization

Known workarounds:

<linker>
	<!--  AntiforgeryRequestToken deserialization issues  -->
	<assembly fullname="Microsoft.AspNetCore.Components.Web">
		<type fullname="Microsoft.AspNetCore.Components.Forms.AntiforgeryRequestToken" preserve="all"/>
	</assembly>
	<assembly fullname="Microsoft.AspNetCore.Components.WebAssembly">
		<type fullname="Microsoft.AspNetCore.Components.Forms.DefaultAntiforgeryStateProvider" preserve="all"/>
	</assembly>
</linker>

Fixes #64693

@ilonatommy ilonatommy requested a review from a team as a code owner December 17, 2025 17:19
Copilot AI review requested due to automatic review settings December 17, 2025 17:19
@github-actions github-actions bot added the area-blazor Includes: Blazor, Razor Components label Dec 17, 2025
@ilonatommy ilonatommy self-assigned this Dec 17, 2025
@ilonatommy ilonatommy requested a review from javiercn December 17, 2025 17:24
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a critical trimming issue in Blazor WebAssembly applications with Individual Identity authentication. When published with PublishTrimmed=true, the antiforgery token state was being lost during the SSR-to-WASM handoff, causing form submissions to break. The fix adds DynamicDependency attributes to preserve the necessary types from IL trimming.

Key changes:

  • Added [DynamicDependency(JsonSerialized, typeof(DefaultAntiforgeryStateProvider))] to preserve the CurrentToken property marked with [PersistentState]
  • Added [DynamicDependency(JsonSerialized, typeof(AntiforgeryRequestToken))] to preserve the constructor and properties for JSON deserialization
  • These attributes are placed on InitializeDefaultServices() method, following the established pattern used elsewhere in the codebase

…HostBuilder.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@ilonatommy ilonatommy enabled auto-merge (squash) December 18, 2025 14:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-blazor Includes: Blazor, Razor Components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PersistentStateAttribute not working in Blazor when server and client have different trimming settings

2 participants