diff --git a/aspnetcore/blazor/includes/compression-with-untrusted-data.md b/aspnetcore/blazor/includes/compression-with-untrusted-data.md index d7d547ef8f..200001daa5 100644 --- a/aspnetcore/blazor/includes/compression-with-untrusted-data.md +++ b/aspnetcore/blazor/includes/compression-with-untrusted-data.md @@ -1,6 +1,6 @@ :::moniker range=">= aspnetcore-9.0" -> [!WARNING>] +> [!WARNING] > With compression, which is enabled by default, avoid creating secure (authenticated/authorized) interactive server-side components that render data from untrusted sources. Untrusted sources include route parameters, query strings, data from JS interop, and any other source of data that a third-party user can control (databases, external services). For more information, see and . :::moniker-end diff --git a/aspnetcore/blazor/javascript-interoperability/index.md b/aspnetcore/blazor/javascript-interoperability/index.md index 29f5c4d69c..f0dcbc2dee 100644 --- a/aspnetcore/blazor/javascript-interoperability/index.md +++ b/aspnetcore/blazor/javascript-interoperability/index.md @@ -32,9 +32,14 @@ Further JS interop guidance is provided in the following articles: ## Compression for interactive server components with untrusted data + + +With compression, which is enabled by default, avoid creating secure (authenticated/authorized) interactive server-side components that render data from untrusted sources. Untrusted sources include route parameters, query strings, data from JS interop, and any other source of data that a third-party user can control (databases, external services). For more information, see and . + :::moniker-end -[!INCLUDE[](~/blazor/includes/compression-with-untrusted-data.md)] ## JavaScript interop abstractions and features package