Security
Understand how Syncfusion Blazor Toolkit components run inside your application, which security tasks remain with your application, and where to verify the Toolkit's source.
How the Toolkit runs
Toolkit components render and execute inside your Blazor application. Their source code is public on GitHub, so you can review it and its dependencies before you adopt it. The Toolkit does not secure your application for you; the sections below separate what it provides from what you own.
Secure your application
Complete these tasks in your own application. The Toolkit does not perform them.
1. Authenticate and authorize
Protect pages with [Authorize] and enforce the same rules on the server. In Blazor WebAssembly, client code can be inspected and modified, so never rely on it alone.
2. Validate input and encode output
Validate user input on the server. Blazor encodes rendered text by default; avoid MarkupString with untrusted content.
3. Protect secrets and transport
Keep keys and connection strings on the server, never in client code or source control. Serve the app and its APIs over HTTPS.
4. Keep dependencies current
Update the Toolkit and other packages regularly, and check them for known vulnerabilities.
dotnet list package --vulnerable --include-transitiveVerify: the command reports no vulnerable packages for your projects.
Review the source
The Toolkit is developed in the open, so you can inspect it before you adopt it:
- Public GitHub repository (opens in a new tab)
- Public issue tracking (opens in a new tab)
- Review public pull requests (opens in a new tab) to see proposed fixes and ongoing code review.
- Versioned releases (opens in a new tab)
- Community contributions: see the Contributing Guide.