Skip to content

Add hosting guidance for web farms #36636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guardrex merged 3 commits into from
Jan 27, 2026
Merged

Add hosting guidance for web farms #36636

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7e93adf
Add hosting guidance for web farms
guardrex Jan 16, 2026
55a1086
Updates
guardrex Jan 16, 2026
0f35bc1
Updates
guardrex Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions aspnetcore/blazor/security/blazor-web-app-with-entra.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
title: Secure an ASP.NET Core Blazor Web App with Microsoft Entra ID
ai-usage: ai-assisted
author: guardrex
description: Learn how to secure a Blazor Web App with Microsoft Entra ID.
monikerRange: '>= aspnetcore-9.0'
Expand Down Expand Up @@ -1148,6 +1149,12 @@ Alternatively, use the following `LogInOrOut` component, which doesn't supply a

For more information on how this app secures its weather data, see [Secure data in Blazor Web Apps with Interactive Auto rendering](xref:blazor/security/index#secure-data-in-blazor-web-apps-with-interactive-auto-rendering).

## Host in a web farm or cluster

Server-side Blazor Web Apps hosted in a web farm or cluster of machines must adopt [*session affinity*](xref:blazor/fundamentals/signalr#use-session-affinity-sticky-sessions-for-server-side-web-farm-hosting) to maintain Blazor circuits for users of the app.

We also recommend using a shared [Data Protection](xref:security/data-protection/introduction) key ring in production, even when the app uses the Interactive WebAssembly render mode exclusively for client-side rendering (no Blazor circuits).

## Troubleshoot

[!INCLUDE[](~/blazor/security/includes/troubleshoot-server.md)]
Expand All @@ -1162,3 +1169,7 @@ For more information on how this app secures its weather data, see [Secure data
* [`AuthenticationStateProvider` service](xref:blazor/security/index#authenticationstateprovider-service)
* [Manage authentication state in Blazor Web Apps](xref:blazor/security/index#manage-authentication-state-in-blazor-web-apps)
* [Service abstractions in Blazor Web Apps](xref:blazor/call-web-api#service-abstractions-for-web-api-calls)
* Data Protection resources
* <xref:security/data-protection/configuration/overview>
* <xref:security/data-protection/implementation/key-storage-providers>
* <xref:security/data-protection/implementation/key-encryption-at-rest>
11 changes: 11 additions & 0 deletions aspnetcore/blazor/security/blazor-web-app-with-oidc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
---
title: Secure an ASP.NET Core Blazor Web App with OpenID Connect (OIDC)
ai-usage: ai-assisted
author: guardrex
description: Learn how to secure a Blazor Web App with OpenID Connect (OIDC).
monikerRange: '>= aspnetcore-8.0'
Expand Down Expand Up @@ -1486,6 +1487,16 @@ The [typed HTTP client](xref:blazor/call-web-api#typed-httpclient) (or [named HT

For more information, see the [Duende Access Token Management documentation for Blazor](https://docs.duendesoftware.com/accesstokenmanagement/blazor-server/).

## Host in a web farm or cluster

Server-side Blazor Web Apps hosted in a web farm or cluster of machines must adopt [*session affinity*](xref:blazor/fundamentals/signalr#use-session-affinity-sticky-sessions-for-server-side-web-farm-hosting) to maintain Blazor circuits for users of the app.
Comment thread
guardrex marked this conversation as resolved.

We also recommend using a shared [Data Protection](xref:security/data-protection/introduction) key ring in production, even when the app uses the Interactive WebAssembly render mode exclusively for client-side rendering (no Blazor circuits). For more information, see the following articles:

* <xref:security/data-protection/configuration/overview>
* <xref:security/data-protection/implementation/key-storage-providers>
* <xref:security/data-protection/implementation/key-encryption-at-rest>

## Troubleshoot

[!INCLUDE[](~/blazor/security/includes/troubleshoot-server.md)]
Expand Down