ASP.NET Web Dev Blog

There's a problem with Blazor, and that is that its not ready.

Which is why they're shipping server side Blazor [0], which is all the stupid parts of Blazor with none of the benefits.

Don't get me wrong, the idea of running .Net in WASM is very appealing to me... but server side Blazor is a daft idea, and it's a mistake.

Here's the model:

- Your component view state is rendered on the server.

- A delta is sent to the front-end.

- The frontend updates the DOM in the browser.

- Any DOM event is sent to the server.

- repeat.

Seems ok?

However, the problems here to understand are:

1) Every UI interaction, from mouse focus, to mouse drag, to click to button down, is sent down the wire to the server to be processed. For high latency situations, this will feel terrible.

2) Every client shares the same server cluster. As such, it scales badly; your application may perform well with 10 users, but for 100 users, you have 10x as much server work happening. Not business logic... UI logic. Will it scale? No one knows, but the money is on 'no'. The server scale-out demands will scale with people viewing the website; effectively this means the UI will lag out under load when the server is busy, the exact opposite of modern SPA applications and apps that remain superficially responsive under server load, and compounding issues generated from (1).

3) As many of the examples show, server side Blazor shows how you can execute arbitrary code on the server as part of your components…

First off, you picked a great time to ask this question because this week there's a free, online conference going on at https://www.dotnetconf.net/. There's a lot of good ASP.NET Core content, so you can see for yourself.

One of my favorite things about the ASP.NET team is that a lot of them were community leaders - speakers, writers, open source library authors, etc. - before being hired at Microsoft. So it's hard to pick just one or two community leaders on the team, as pretty much everyone regularly speaks at conferences, publishes open source code, blogs, etc. So it's really hard to make a short list! Hopefully this is still useful to someone.

As several others have mentioned, you really should start with Scott Hanselman (https://www.hanselman.com/ and @shanselman).
[Disclaimer: he's my boss, but I joined his team because I was a big fan long before either of us worked at Microsoft]

The ASP.NET Weekly Community Standup is a great place to connect both with the team and with the leading members of the developer community. It's at https://live.asp.net/ with Damian Edwards, Scott Hanselman and me. Damian Edwards (https://twitter.com/damianedwards) is the program manager for the ASP.NET team. During the show, I usually share 10ish links to top posts, open source projects, etc. by the community. We feel like the ASP.NET Community is made up of developers both inside and out of Microsoft, so you'll see a mix. The links are usually in the show notes, and we also tweet the…

For traditional sessions:

1. All You Ever Wanted to Know About Sessions In Node.js (Stormpath) - https://stormpath.com/blog/everything-you-ever-wanted-to-know-about-node-dot-js-sessions

2. Express.js Production Best Practices - https://expressjs.com/en/advanced/best-practice-security.html

3. express-session (npm module) - https://ewiggin.gitbooks.io/expressjs-middleware/content/express-session.html

4. Node.js authentication strategy using Passport.js and Redis - https://blog.risingstack.com/node-hero-node-js-authentication-passport-js/

For JSON Web Tokens:

1. JWT Handbook: https://auth0.com/e-books/jwt-handbook

2. IETF Specification: https://tools.ietf.org/html/rfc7519

3. https://jwt.io/

4. Authentication in React Applications, Part 2: JSON Web Tokens - https://vladimirponomarev.com/blog/authentication-in-react-apps-jwt

6. Token Authentication Implementation - https://docs.docker.com/registry/spec/auth/jwt/

7. JWT Validation and Authorization in ASP.NET Core - https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-authorization-in-asp-net-core/

Going back to .csproj files, but improving those.

From [0]: "Question: project.json is going away? Sadface

What were the things we liked? It was small, contained NuGet information, and could be edited by hand. Damian does not want to lose any of those benefits, and that is why they are working in several steps to complete this migration. Additionally, the team is building tooling at the command line so that you don’t have to work with the project file directly. Consider a possible npm-like command like “dotnet install json.net –save” to add a NuGet package to your project. There will be first class commands like this available.

The new MSBuild will not have a complete list of every file, so that should reduce the size of the build file. It will still be XML, but the team is committed to making that experience better for all .NET projects. This will be an enhanced MSBuild that has all of the best parts of project.json"

[0]https://blogs.msdn.microsoft.com/webdev/2016/05/11/notes-from-the-asp-net-community-standup-may-10-2016/

Yes, 2 only applies to server-side Blazor.

"Server-side Blazor" itself will be renamed[0] to Razor Components so as to disambiguate it with WASM-in-the-browser, which will still be called Blazor.

Razor Components seems to be a blend of different kinds of web programming models, as described by the parent poster:

- Traditional: POST + Redirect + GET

- Single Page App: Thick client in JS

- Razor Components: Traditional, but instead of POST+Redirect, it uses Web Sockets to asynchronously update state.

Razor Components are being shipped because it's building off well-known, mature technologies. OTOH, Blazor (WASM in browser) is still baking. For example, there is no tree-shaking to minimize the minimize the size of components needed to run your Blazor app. (IIRC, the average size of a basic nav app is ~2MB.)

[0]: https://blogs.msdn.microsoft.com/webdev/2018/10/02/blazor-0-6-0-experimental-release-now-available/

Laravel Mix[0], Rails Webpacker[1], and Dotnet's Spa Services[2] (among others) all do fantastic jobs getting you going with new frontend tech alongside backend apps. It's kind of amazing that the JS world does a bit of a worse job here. Too much focus on the hip new way vs getting things done? Seems boilerplate exists mostly to make "Universal" apps now, but I've yet to see a straightforward attempt at that (not to mention, the distinction for things that work in-browser vs not is going to be confusing for beginners in the single-language-JS approach). create-react-app is fine but it only does half the job.

[0] https://laravel.com/docs/5.5/mix

[1] https://github.com/rails/webpacker

[2] https://blogs.msdn.microsoft.com/webdev/2017/02/14/building-single-page-applications-on-asp-net-core-with-javascriptservices/