Direct API Access

This page publishes the canonical direct browser-to-API guidance for standalone Blazor WebAssembly applications.

Use direct API access when the browser should call the RecroGrid Framework API without a host-side proxy.

Base address

Configure the RecroGrid Framework API base address in the client application settings.

"Recrovit": {
  "RecroGridFramework": {
    "API": {
      "BaseAddress": "https://{API-DOMAIN}"
    }
  }
}

This value should point to the real API origin used by the standalone Blazor WebAssembly client.

CORS

Because the browser calls the API directly in this model, the API must allow the client origin through CORS.

A typical API-side policy looks like this:

builder.Services.AddCors(options =>
{
    options.AddPolicy("RGF.Client", policy =>
    {
        var allowedOrigins = builder.Configuration
            .GetSection("CorsSettings:AllowedOrigins")
            .Get<string[]>();
        if (allowedOrigins != null)
        {
            policy.WithOrigins(allowedOrigins)
                  .AllowAnyHeader()
                  .AllowAnyMethod();
        }
    });
});

"CorsSettings": {
  "AllowedOrigins": [
    "https://{CLIENT-DOMAIN}"
  ]
}

Authentication expectation

Direct API access assumes the API-side security model accepts browser-originated bearer tokens from the configured identity provider.

If you do not want browser-originated bearer tokens or cross-origin API traffic, use the recommended host/proxy application model instead.