Moving a user from one application host to another often looks harmless. A button opens a browser, the user continues, and the original client waits for them to return.

Architecturally, that is not merely navigation. It is a trust-boundary decision.

This becomes especially important when one user experience runs across several .NET hosts: perhaps an ASP.NET Core site, a Blazor WebAssembly client, and a .NET MAUI hybrid app. The shared components may look identical, but the hosts do not own the same secrets, sessions, callbacks, or security guarantees.

The lesson is simple: when a workflow crosses hosts, hand off intent, not authority.

The tempting shortcut

Suppose a client has already loaded an order-like resource and can display the next sensitive action. It is tempting to let every host render the same provider form or carry the current access proof into the browser.

That preserves continuity, but it also widens the boundary.…