[Blazor] Security - interactive-server-side-rendering - script tags

[hakenr]

Script tags aren't allowed and shouldn't be included in the app's component render tree. If a script tag is included in a component's markup, a compile-time error is generated.

I'm not aware of any such compile-time behavior.
While it's not recommended to include script tags in your interactive components (since the behavior can be tricky), there's no built-in mechanism that prevents you from including a script tag in the render tree.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/blazor/security/interactive-server-side-rendering.md	aspnetcore/blazor/security/interactive-server-side-rendering

[guardrex]

This goes back to the inception of the article five years ago on #13962, written by Javier and reviewed by Steve Sanderson and Ryan Nowak when he worked on Blazor. It's at Line 194 of ...

https://github.com/dotnet/AspNetCore.Docs/pull/13962/files#diff-4962dbf450346ed225e83e082be3ddbae62e523fd1980145aa2af347ec62a2eaR194

Stand-by while I get them on here to take a look.

[guardrex]

UPDATE (11/25): There might be a delay. We're in the Thanksgiving 🦃 holiday season here, so it might take a week or longer to advance this. Stand-by, and we'll get back to this ASAP! 🏃‍♂

[guardrex]

I sent Javier another message on this. He might respond soon.

I'm going to perform an auto-responder workflow test on this PR for the Thanksgiving holiday 🦃 by taking my review assignment off and re-adding it.

[SteveSandersonMS]

See dotnet/razor#8744

There used to be a compile-time error if you had a <script> inside .razor due to the tricky bits that @hakenr mentions, and because at that time we didn't think there were valid scenarios for people doing it.

However from .NET 8 onwards when we added full SSR support, we judged that there were important scenarios for using <script> with SSR so the balance tipped towards allowing it without any warnings or errors.

[guardrex]

Thanks, @hakenr! I'll update a 2nd spot where this sentiment exists on a separate PR shortly.