ASP.NET Core updates in .NET 9 Preview 6

[danroth27]

Here's a summary of what's new in ASP.NET Core in this preview release:

• Fingerprinting of static web assets
• Improved distributed tracing for SignalR
• Enhancements to Microsoft.AspNetCore.OpenAPI
• Analyzer to warn when [Authorize] is overridden by [AllowAnonymous]
• ComponentPlatform renamed to RendererInfo
• Split large HTTP/2 headers across frames

ASP.NET Core updates in .NET 9 Preview 6:

• What's new in ASP.NET Core in .NET 9 documentation.
• Breaking changes
• Roadmap

.NET 9 Preview 6:

• Discussion
• Release notes

[jaime-olivares]

The typo of PR #56244 's title is reflected here ("anymous")

[danroth27]

Whoops! Thanks! Should be fixed now.

[rachavz]

Please remove SignalR from blazor use AJAX instead

[kresog]

I'll just say that I've been using Blazor since beta version and I absolutely hate SignalR. It's the worst part of the whole Blazor concept.
It's performance is catastrophic even in intranet environment with websockets enabled on server and firewalls and very low number of users. I think it is the biggest show stopper for wider adoption of Blazor. Blazor is in usable state almost few years now but there are only a few brave souls that use it on public web. Isn't that suspicious enough to MS to think about changing something in Blazor? Adding something like "Ajax interactive mode" would be a very nice and useful option.
Regarding state management, why not use something similar to ViewState which was used in WebForms with EnableViewState=true/false option + an option to choose where to store the state (local storage, cookie or server side session)?
Or.. to implement something similar to dotVVMs state handling? As I remember, .dotVVM is using Steve Sandersons KnockoutJS + Ajax for interactivity, and is part of .NET Foundation.
btw. @danroth27, regardless of the criticism, thank you for your efforts on developing Blazor :)

[kresog]

And one more thing... Recently I've built a Blazor Server app for internal use only which uses Windows Authentication.
Members of the board want to use app on their iPhones and iPads. And, gues what, app does not work on that devices.
Why? Because WebKit (which is used as rendering engine for all browsers on iOs devices) does not support Basic Authentication/Windows Authentication over WebSockets! That's another good reason why MS should implement "Ajax interactive mode" .

[danroth27]

@rachavz Thanks for these details! Do you want to go ahead and suggest this capability in a GitHub issue? That way we can discuss it with the rest of the community.

[danroth27]

@kresog Can you share what specific performance problems you ran into? The performance of your app can of course vary significantly based on what you're trying to do and how you implement it. But we use Blazor Server for several internal Microsoft apps that regularly handle 10s of thousands of current users without issue. You can find our recommended Blazor performance best practices here: https://learn.microsoft.com/aspnet/core/blazor/performance.

From a performance perspective, I'm not really sure how switching from WebSockets to Ajax would help. If anything, it seems like using Ajax might actually increase the overhead of processing user interactions by creating new connections instead of reusing an existing one. The main benefit I can think of with using Ajax would be to reduce the overhead of having to handle lots of persistent WebSocket connections that might not be actively in use, but that seems like more of a scaling concern than a performance benefit.

[kresog]

Hi @danroth27,
thanks for answer and directions. My team and I are doing our best to develop our apps in accordance with the best practice guidelines (most of the time :)).
Regarding Blazor Server and SignalR performance issues, let me first describe the context/ environment in which the applications are running.
Our network is a well-defended local network (paranoid sys admins) and network hardware is "latest and the greatest". Unfortunately we don't use Azure, but I hope we will in a year or two. All servers are running Win Server 2022. We use local AD and Windows Authentication for authentication and local API/service for authorization.
Basically, all Blazor Server applications (.net 8) work 90% of the time without any problems. Fast and performant as expected from apps with websockets. However, during the day there are intervals of couple of hours when the network is under heavy load and this is where problems arise. It happens that the SignalR circuits start and keep breaking. The application works fine for a few minutes and then the circuit breaks. During that time, other older applications that were made with .NET 4.8 ASP.NET MVC + jQuery/AJAX or newer ones made with .net 8 Razor Pages + HTMX + AlpineJS work without any problems. Furthermore, I've noticed that Blazor Server applications that use Windows Authentication generally run much slower and have the most problems with SignalR circuits, unlike applications that do not use it (Win auth).
Getting the Balzor Server application to work with the Windows Authentication mechanism is a story in itself. It was a week long hair pulling session :) I couldn't find any examples anywhere of how to do that without using AzureAD, Entra, Identity Server or ASP.NET local identity database. We don't use any of that (so as many other companies). Only our authorization service/api and Windows Auth.
Blazor is an amazing technology and I really enjoy working with it, but sometimes that can become a very frustrating experience. For my colleagues and me, the most common source of frustration was related to authentication. In a moment of weakness, I was tempted to rewrite the entire application using Razor pages, Alpine and HTMX, but fortunately changed my mind on time :)
Sorry for longer post and bad english.
Thnx

ps.
Just after writing this post, I came up with a hybrid solution which could possibly solve the performance problems and problems related to iPhone and iPad + WinAuth + websockets.
In short, solution is as follows:

1. Create Razor Pages web site which uses WinAuth and has only a landing page.
   When user lands to the site, app gets users AD username, authorizes user via API, writes JWT into a HttpOnly cookie and redirects user to the Blazor Server app (which in this case don't use WinAuth any more).
2. When user lands to Blazor Server site, in App.razor, OnInitializedAsync event hander read the jwt from the cookie, and write user data into a server side session,.. and life is good.
   For now POC is working really nice. I hope that this solution could be used for Blazor WASM apps also. We'll see..