---
title: Blazor: don't bind a value you want to disable
date: 2025-09-26
tags: blazor, dotnet, security
summary: A disabled input with two-way binding can be re-enabled in the browser. Use a plain value instead.
---

I was adding authorization to a Blazor Server app. One form field should only be editable if the user passes a policy. Easy, right?

```razor title="AuthorizeView with binding"
<AuthorizeView Context="avc" Policy="IsAssignedToUserPolicy" Resource="@todoItem">
    <Authorized>
        <InputText id="text" class="form-control" @bind-Value="todoItem.Text" />
    </Authorized>
    <NotAuthorized>
        <InputText id="text" class="form-control" disabled @bind-Value="todoItem.Text" />
    </NotAuthorized>
</AuthorizeView>
```

The only difference is the `disabled` attribute. That is the problem: anyone can remove `disabled` in the browser dev tools, edit the text, and the `@bind-Value` writes it straight into your model.

An `InputText` is also overkill for something nobody can edit. So in the `NotAuthorized` branch I use a plain input:

```razor title="plain input, no binding"
<NotAuthorized>
    <input type="text" disabled id="text" class="form-control" value="@todoItem.Text" />
</NotAuthorized>
```

Now the value is set one way, from the model to the page. Nothing is bound back, so removing `disabled` in the browser changes nothing on the server.

> TIL: if a field must not be edited, don't bind it.

Also check the policy again where you save, because the UI is not a security boundary.