BlazorFrame v2.1.0 — nugetz
pkg
Tim-Maes/ BlazorFrame v2.1.0 .NET 8.0
A enhanced secure Blazor iFrame component with built-in origin validation, bidirectional messaging, navigation tracking, and comprehensive security features.
Get Started dotnet CLI PackageReference Package Manager
$ dotnet add package BlazorFrameReadme BlazorFrame
A security-first Blazor iframe component with automatic resizing, cross-frame messaging, and comprehensive Content Security Policy integration.
Features
Security-First Design - Built-in origin validation, message filtering, and sandbox isolationContent Security Policy - Comprehensive CSP integration with fluent configuration APICross-Frame Messaging - Secure postMessage communication with validationSandbox Support - Multiple security levels from permissive to paranoid isolationEnvironment-Aware - Different configurations for development vs productionAutomatic Resizing - Smart height adjustment based on iframe content
Documentation
Complete Documentation
:rocket: Quick Start
Installation dotnet add package BlazorFrame
Basic Usage @using BlazorFrame
<!-- Simple iframe with automatic security -->
<BlazorFrame Src="https://example.com" />
<!-- Production-ready configuration -->
<BlazorFrame Src="https://widget.example.com"
SecurityOptions="@securityOptions"
OnValidatedMessage="HandleMessage"
OnSecurityViolation="HandleViolation" />
@code {
private readonly MessageSecurityOptions securityOptions = new MessageSecurityOptions()
.ForProduction() // Strict security settings
.WithBasicSandbox() // Enable iframe sandboxing
.RequireHttps(); // Enforce HTTPS transport
private Task HandleMessage(IframeMessage message)
{
Console.WriteLine($"Received message from {message.Origin}: {message.Data}");
return Task.CompletedTask;
}
private Task HandleViolation(IframeMessage violation)
{
Console.WriteLine($"Security violation: {violation.ValidationError}");
return Task.CompletedTask;
};
}
Configuration Examples // Development environment - relaxed security
var devOptions = new MessageSecurityOptions()
.ForDevelopment()
.WithPermissiveSandbox();
// Production environment - strict security
var prodOptions = new MessageSecurityOptions()
.ForProduction()
.WithStrictSandbox()
.ValidateAndThrow();
// Payment widgets - maximum security
var paymentOptions = new MessageSecurityOptions()
.ForPaymentWidget();
Content Security Policy <BlazorFrame Src="https://widget.example.com"
CspOptions="@cspOptions"
OnCspHeaderGenerated="HandleCspGenerated" />
@code {
private readonly CspOptions cspOptions = new CspOptions()
.ForProduction()
.AllowFrameSources("https://widget.example.com")
.WithScriptNonce("secure-nonce-123");
private Task HandleCspGenerated(CspHeader cspHeader)
{
// Apply CSP header to HTTP response
// HttpContext.Response.Headers.Add(cspHeader.HeaderName, cspHeader.HeaderValue);
return Task.CompletedTask;
}
}
Security Features
Sandbox Security Levels Level Description Use Case None No restrictions Trusted content only Basic Scripts + same-origin Most trusted widgets Permissive + forms + popups Interactive widgets Strict Scripts + same-origin only Display widgets Paranoid Scripts only Untrusted content
Message Validation All iframe messages are automatically validated for:
Origin verification - Ensures messages come from allowed domainsContent validation - JSON structure and size limitsSecurity filtering - Blocks malicious patterns and script injectionCustom validation - Extensible validation pipeline
Demo
Requirements
.NET 8.0 or laterBlazor Server or Blazor WebAssembly Modern browser with ES6 modules support
Browser Support
Chrome 91+
Firefox 90+
Safari 15+
Edge 91+
Support
License
Built with :heart: for the Blazor community
