Security concern with accessing server-side Blazor services from a different DI scope / semaphore needed? about aspnetcore

[guardrex]

Thanks @habex-ch! ... I'll keep an 👁️ on this and add remarks to the article depending on what the product unit engineer(s) say.

[javiercn]

@habex-ch thanks for contacting us.

It's not a security threat. It's an async local which is not really static but scoped to the current async call context. See https://learn.microsoft.com/en-us/dotnet/api/system.threading.asynclocal-1?view=net-8.0 for details.

In addition to that, the provider being exposed in the sample is the one for the circuit. A similar pattern is used for example with IHttpContextAccessor even though is "hidden" behind a singleton.

aspnetcore/src/Http/Http/src/HttpContextAccessor.cs

Line 12 in 613c1e9

public class HttpContextAccessor : IHttpContextAccessor

[habex-ch]

@javiercn Thank you very much for your explanation.

I totally missed the concept behind AsyncLocal because it is hidden behind the value-property setter.
I have done a deep dive into the AsyncLocal concept and I get it now.

I am relieved that there is no security issue there.