Security implications of using IHttpContextAccessor in Blazor Server

[Bouke]

The documentation note the following on IHttpContextAccessor:

Additionally, again for security reasons, you must not use IHttpContextAccessor within Blazor apps. Blazor apps run outside of the context of the ASP.NET Core pipeline. The HttpContext isn't guaranteed to be available within the IHttpContextAccessor, nor is it guaranteed to be holding the context that started the Blazor app.

The default HttpContextAccessor is implemented using AsyncLocal:

https://github.com/dotnet/aspnetcore/blob/589aa11b5c631ce719e0530d66be8324a6d79169/src/Http/Http/src/HttpContextAccessor.cs#LL11C108-L11C108

I fail to understand the security implications of using IHttpContextAccessor in Blazor Server. AsyncLocal in general must flow with the user's SignalR connection†. So that would also be the case for the HttpContext stored in this AsyncLocal. This is also what we're seeing in our tests.

• Under what situations would IHttpContextAccessor return a different HttpContext than the one that started the Blazor app? (i.e. another user)
• How is this use of AsyncLocal any different from other uses of AsyncLocal and (apparently) a security consideration?
• How can we pass the originating HttpContext from the "context of the ASP.NET Core pipeline" safely to the Blazor Server app?

† If that isn't the case, then all bets are off.

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: ff954815-0f8b-9f1b-9772-1657744b4f9e
• Version Independent ID: ed7d726d-41c6-73d8-d564-91530b4935c3
• Content: Threat mitigation guidance for ASP.NET Core Blazor Server
• Content Source: aspnetcore/blazor/security/server/threat-mitigation.md
• Product: aspnet-core
• Technology: aspnetcore-security
• GitHub Login: @guardrex
• Microsoft Alias: riande

[guardrex]

Hello @Bouke ... Please open for the product unit, as it's more of a "product support" type of question at this point. You can just copy those opening remarks right into an issue there. Note that they might be out for the ⛄ holidays. You might get a delayed response. Open the issue here ...

https://github.com/dotnet/aspnetcore/issues

Please add ...

cc: @guardrex https://github.com/dotnet/AspNetCore.Docs/issues/27944

... to the bottom of your opening comment so that I can follow along. I might re-open this for doc work depending on what they say.

[guardrex]

I'm going to add to what we have in this topic, and I'll probably add a bit on this to the Blazor-SignalR Fundamentals doc.

I'll probably leave this issue open until I hear back if they're going to work on that 2019 SignalR issue and/or if Javier has anything else that he wants done in the Blazor node.

dotnet/aspnetcore#45699

The doc work will need to wait until 23Q1. I'm buried in security content through the EOY 🗻⛏️😅.