The Blazor Hybrid model lets you share Razor components between a Blazor Server web app and a MAUI mobile app — but authentication cannot be shared the same way. SSR imposes strict constraints on cookie auth, while MAUI relies on platform secure storage. This guide walks through both paths in a single three-project solution.

The solution uses three projects. Shared Razor components and services live in YourApp.Shared; the web and mobile apps each register platform-specific implementations of a common auth interface without duplicating any UI logic.

---

All four NuGet packages go into YourApp.Shared — neither the web nor the mobile project needs to reference them directly for auth to work.

Add the following global usings to _Imports.razor in YourApp.Shared so all Razor pages can access auth types without per-file imports:

@using Microsoft.AspNetCore.Authorization
@using Microsoft.AspNetCore.Components.Authorization
@using YourApp.Shared.Layout
@using YourApp.Shared.Pages
@using YourApp.Shared.Services

---

The core pattern is a single ICustomAuthenticationService interface with two concrete implementations — one for the server using cookie auth, one for MAUI using SecureStorage. Each project’s DI container registers its own version.

Define the interface in YourApp.Shared/Services/ICustomAuthenticationService.cs:

public interface ICustomAuthenticationService
{
    Task SignInAsync(string username);
    Task SignOutAsync();
    Task<ClaimsPrincipal> GetCurrentUserAsync();
}

In YourApp.Web/Program.cs, configure cookie authentication and register the server-specific services:

builder.Services.AddAuthentication("Cookies")
    .AddCookie("Cookies", options => { options.LoginPath = "/login"; });

builder.Services.AddAuthorizationCore();
builder.Services.AddHttpContextAccessor();
builder.Services.AddScoped<ICustomAuthenticationService, ServerAuthenticationService>();
builder.Services.AddScoped<AuthenticationStateProvider, ServerAuthenticationStateProvider>();
builder.Services.AddScoped<UserService>();

In YourApp.Mobile/MauiProgram.cs, register the MAUI-specific auth services:

builder.Services.AddAuthorizationCore();
builder.Services.AddScoped<CustomAuthenticationStateProvider>();
builder.Services.AddScoped<AuthenticationStateProvider>(provider =>
    provider.GetRequiredService<CustomAuthenticationStateProvider>());
builder.Services.AddScoped<ICustomAuthenticationService, CustomAuthenticationService>();
builder.Services.AddScoped<UserService>();

---

These three components live entirely in YourApp.Shared and are consumed by both web and mobile without modification. The user store is intentionally minimal — replace plain-text passwords with a hashed database before going anywhere near production.

---

Three files need updating to wire auth into the app’s routing and navigation UI. All three live in or reference YourApp.Shared.

---

The implementation above is a functional skeleton — suitable for local development and prototyping. Four areas must be addressed before it touches real users.