Remark on DP protection of persisted component state

[guardrex]

Fixes #33767

Still guessing a little on the exact phrasing.

cc: @hakenr

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/blazor/components/prerender.md	aspnetcore/blazor/components/prerender
aspnetcore/blazor/components/prerendering-and-integration.md	aspnetcore/blazor/components/prerendering-and-integration

[guardrex]

prerendered data sent to a client ... in-transit

I might need to reword these remarks to make this say it's data sent round-trip for server payloads. Currently, it sounds like it's one-way server to client.

Improved on the next two commits.

[hakenr]

My proposal:

The persisted prerendered state is transferred to the interactive client, where it's used to restore the component state. In InteractiveWebAssembly render mode, this data is exposed to the browser and must not contain any sensitive information that needs to remain secure. For InteractiveServer render mode, ASP.NET Core Data Protection ensures that data is transferred securely. InteractiveAuto render mode combines WebAssembly and Server interactivity, so it's also necessary to consider data exposure to the browser, as in the InteractiveWebAssembly case.

This is intended as a suggested level of simplification, not exact wording. I’d avoid going into details about in-transit or similar concepts.

[guardrex]

Yes, that's nice. I'll put it in place with a few NIT updates.

[guardrex]

Ok ... try it now 👀.

[guardrex]

Since we're coming to agreement, I'll drop the Javier review request.

[hakenr]

lgtm