Follow up on: UseEndpoints behaves differently in Development and Production env

[PeterDraex]

As the original issue (#44491) was closed, I'm opening a follow up issue.

Context
Hosted Blazor WebAssembly

The following two middleware pipeline definitions behave differently.

app.MapRazorPages();
app.MapControllers();
app.MapFallbackToFile("index.html");

and

app.UseEndpoints(endpoints =>
{
    endpoints.MapRazorPages();
    endpoints.MapControllers();
    endpoints.MapFallbackToFile("index.html");
});

The first code chunk works well in all environments. The second works only in Development environment, unless builder.WebHost.UseStaticWebAssets(); is enabled.

Questions

• Can you help me better understand the difference between the two code chunks above? Why is the call to endpoints.UseStaticWebAssets not necessary with the first code, but is necessary with the second code?
• Is it safe to enable builder.WebHost.UseStaticWebAssets(); in Production environment? Documentation advises against enabling this in production for Blazor Server apps. Is the recommendation different for WebAssembly apps? Why?
• If it is not safe to enable, is there any other way to serve multiple Clients from one Server app?

[javiercn]

• Can you help me better understand the difference between the two code chunks above? Why is the call to endpoints.UseStaticWebAssets not necessary with the first code, but is necessary with the second code?

The host automatically plugs in static web assets during development, but it does not do so in other environments.

• Is it safe to enable builder.WebHost.UseStaticWebAssets(); in Production environment? Documentation advises against enabling this in production for Blazor Server apps. Is the recommendation different for WebAssembly apps? Why?

It will serve files from paths outside your wwwroot folder (files in the nuget packages directory and potentially other referencing projects containing assets). There is nothing implicitly unsafe about it, but we are generally extra careful and plug it only during development to avoid unforeseen issues.

It is meant as a feature for development purposes. When you publish the app all files are copied to the wwwroot folder of the published app.

On a correctly configured production environment it might not even work as I would expect the permissions to be limited to the app folder.

If it is not safe to enable, is there any other way to serve multiple Clients from one Server app?

Not sure what this question is about.

Static web assets creates a virtual file system during development that stitches together multiple different paths on disk to project the illusion that all files are being served from the wwwroot folder of the hosting app while allowing you to make changes in the original files locations and see those changes reflected without having to rebuild the app (it does not copy files).

When you publish your app, those files are copied into the final publish output folder. If you are on a production environment, you should be running the published app, at which point, static web assets are just files in your wwwroot folder and no code is involved at runtime.

To be absolutely clear, UseEndpoints does not behave differently, the difference is that when you do dotnet run in development, static web assets is plugged in and index.html is available and when you do dotnet run in production it is not available by default unless you plug it yourself.

[PeterDraex]

Ok, I understand now. Thank you for explanation!