LabsLab 06 · Intermediate · 20 min
Authentication and policies
Compare anonymous, student, and instructor access with server-enforced policies.
In this Blazor WebAssembly host: personas are browser-only and can be changed by anyone. Only a server can enforce the instructor policy.
Current persona: anonymous.
This static demo has no server. A browser-only persona changes what the page renders, and anyone can change code running in their browser,
so nothing here is authorization. Run the app locally to see the server enforce the instructor policy with 401, 403 and 200 responses.
The UI hides instructor content from anonymous and student personas. Hiding content is not authorization.
Why it works
This local lab issues demo cookies for fixed personas. Antiforgery protects form posts. The instructor endpoint requires a policy, regardless of what the UI displays.
Try it yourself
Try the instructor endpoint anonymously, as a student, and as an instructor. Inspect the 401, 403, and 200 responses.