Forum Discussion
Enhanced Security hinders performance of WASM applications (Including Blazor)
Hi, is there any official advice on what to do about "enhanced security" absolutely nuking performance of WASM?
- https://github.com/dotnet/aspnetcore/issues/48754
- https://github.com/dotnet/aspnetcore/issues/56806
These existing tickets that were closed on the AspNetCore side, and it's been many years it seems and this is still an issue? I've submitted feedback through edge on this before but I have no way of knowing if this has been answered/looked at.
We have a user who's required to have it on by policy and can't add it to the whitelist, and it's causing a pretty severe performance degradation.
It just seems odd to me that the same company can produce two tools, and one of them absolutely breaks the other with seemingly no way to manage the downside at all.
2 Replies
- CrdlPlsCopper Contributor
Unfortunately, therein lies the problem. We can't ask them to add this in the bypass as they believe this is crucially an important security feature. We can explain the technology issues behind what is happening, but fundamentally this is a problem where they will now believe that there is an issue with our tool itself, that we cannot build to "the leading browser's security standards" - while both the browser and the library used to make the tool are made by the same company! How can we justify using this when we will get the blame for an issue we have no power over solving, other than completely dropping webassembly in its entirety.
At the very least, the fact that it seems like both the Edge team and the Blazor team seem to say there is nothing that can be done other than literally switching the feature off, makes it very hard for us to actually do anything about this issue if a customer decides it's necessary.
Your Blazor WebAssembly slowdown under policy-enforced Edge Enhanced Security matches Microsoft’s documented behavior. Enhanced Security runs WebAssembly through an interpreter, which Microsoft warns might not provide expected performance; this is a security tradeoff, not a Blazor configuration fault.
First, review applied policies and record EnhanceSecurityMode, EnhanceSecurityModeAllowUserBypass, and JavaScript JIT policies. If policy controls the setting and user bypass is disabled, the user cannot correct it locally. Ask the Edge administrator to add the application’s domain to EnhanceSecurityModeBypassListDomains, refresh policy, restart Edge, and retest. If DefaultJavaScriptJitSetting also blocks JIT, the administrator should review JavaScriptJitAllowedForSites; its exceptions operate at registrable-domain granularity and apply separately to embedded frames. Avoid disabling Enhanced Security globally unless the organization accepts that reduced protection. If domain exceptions are prohibited, Microsoft documents no client-side Blazor setting that restores JIT performance. Capture the Edge version, applied policies, and a performance trace, then open a Microsoft support case.