Blazor Penetration Testing
In Blazor WebAssembly, [Authorize] hides menu items; it does not protect the API underneath. We test whether your API enforces access on its own, and what the shipped code exposes. CREST-certified testers, fixed price from £3,240 for a 3-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Blazor WebAssembly ships your compiled application to the browser, so its authorisation attributes and anything placed in a client-side settings file are visible to anyone who opens developer tools. We test what a user can recover from that download.
Why Blazor authorisation has to live on the server, not the component
Blazor WebAssembly runs entirely in the browser, and Microsoft’s own security guidance is explicit that the [Authorize] attribute on a component controls what the UI shows, because there is no server enforcing it at that point. We test every API endpoint behind the app independently, on the assumption that a user can reach it directly regardless of what the component would have shown them.
The assemblies that make up a Blazor WebAssembly app are downloaded to the browser to run, and anything placed in the wwwroot folder, including a client-side appsettings.json, ships with them. We test what a user can recover from those files and the compiled code itself, and whether any configuration value there should have stayed on the server.
Where an app uses Blazor Server, or the interactive server render mode of a Blazor Web App, UI state runs over a SignalR circuit instead, and a different set of assumptions applies to session and reconnection handling. We test whichever hosting model and render modes your app actually uses, Server, WebAssembly or Auto, rather than assuming one authentication pattern covers all of them.
SCOPE
What we pen test on a Blazor application
Component-Level Authorisation
[Authorize] on a Blazor WebAssembly component controls rendering only, since there is no server enforcing it at that point. We test whether the underlying API independently enforces the same rule.
API Enforcement Behind the UI
Every endpoint the Blazor app calls needs its own authorisation check regardless of what the component displays. We test each one directly, without going through the client at all.
Downloadable Assemblies and Client Logic
Blazor WebAssembly ships its compiled assemblies to the browser to run. We test what business logic, routes or validation rules an attacker can recover by inspecting them.
Configuration and Secrets in wwwroot
Configuration files in the web root are visible to the client by design. We test whether anything placed there, including client-side appsettings values, should have stayed server-side.
SignalR Circuit Handling
Blazor Server keeps UI state on a real-time SignalR circuit tied to the connection. We test circuit and reconnection handling for state that carries between users.
Render Mode Consistency (Server, WebAssembly, Auto)
A Blazor Web App can mix render modes per component, including switching to Auto at runtime. We test that authorisation holds however a given component is currently rendering.
Authentication State Across Hosting Models
The authentication state provider differs between server-rendered and client-rendered Blazor. We test that a user’s identity and role carry across every mode your app actually uses.
API Permissions and Object Access
The ASP.NET Core API behind a Blazor app needs its own object-level access checks. We test them independently of the Blazor client, including a request built by hand rather than through the app’s UI.
Session and State Management
Beyond the SignalR circuit, we test how session and application state are scoped, so one user’s data cannot surface in another’s session after a reconnect.
The .NET Estate Around the App
Blazor sits on the same ASP.NET Core runtime as the rest of your .NET estate. Where that estate is wider than one app, our .NET penetration testing covers the rest of it.
OUR PROCESS
Blazor Penetration Testing: From Scope to Attestation
Scope and Access
We agree the hosting model in use, Server, WebAssembly or a Blazor Web App with mixed render modes, the URLs and environments in scope, and accounts for every role across each mode.
Render Mode and API Mapping
We map which components use which render mode, and catalogue every API endpoint the app calls regardless of what the current UI shows for a given user.
Manual Testing
A CREST-certified tester manually tests authorisation on the API layer, inspects the downloaded WebAssembly assemblies for exposed logic or configuration, and tests SignalR circuit handling.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Blazor pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Blazor Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Blazor For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Blazor Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Blazor application?
We need at least one authenticated account for every role your app distinguishes between, across every hosting model or render mode in use. API documentation or a schema export for the backend helps but is not required.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as bulk deletes and outbound emails, and we do not run destructive tests against real customer records without that agreement in writing.
How long does a Blazor penetration test take?
A single Blazor application sits in our 3-day single-framework scope, with a report typically landing within about a week of kickoff. An app split across several backend services moves into a larger scope.
Do you test Blazor Server, WebAssembly and Auto the same way?
The testing adapts to whichever hosting model and render modes your app uses. We check authorisation, state handling and what the client downloads for each mode present, rather than assuming one pattern covers a mixed app.
What is out of scope for a single-framework Blazor test?
Infrastructure-level issues in the underlying server, network or cloud configuration are out of scope and covered by our cloud penetration testing service instead. A separate downstream microservice not called directly by this application is also scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the relevant authorisation attributes, render mode configuration and API controllers alongside testing, is available if you want faster or deeper coverage of specific findings.
Does Microsoft have a customer penetration-testing policy for Blazor?
Blazor is framework code you deploy and control yourself rather than a shared multi-tenant service. We confirm Microsoft’s and your hosting provider’s current terms during scoping before testing begins.
Is the downloaded WebAssembly bundle itself part of the test?
Yes. We review what is recoverable from the downloaded assemblies and any static files served alongside them as part of the application testing, not as a separate exercise.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Blazor application
In Blazor WebAssembly, [Authorize] hides menu items; it does not protect the API underneath. We test whether your API enforces access on its own, and what the shipped code exposes. CREST-certified testers, fixed price from £3,240 for a 3-day single-framework scope, quoted within 24 hours.
