First, I am trying to understand how to protect blazor application from attacks. I have a JavaScript function that calls c # code. I've noticed that when I publish a project, the static files are not obfuscated. This means that I can see the code of my js files on the client side and I can easily modify these files. I wonder how to protect this situation as an attacker can inject an infinite loop into my application, then the server side CPU will process this call.

For example:

I have line:

callback.invokeMethodAsync('OnEvent', "sample data");

attacker can write this in devtool on client side:

while(true) 
   callback.invokeMethodAsync('OnEvent', "sample data");

Then my application processes infinitely with the method:

OnEvent(string data)

The second problem is the transparency of static files in the ./_content folder. I can see all the libraries used in my project. I think this is a potentially dangerous problem because when the library manufacturer makes a vulnerability, my entire application is exposed to attack. Has anyone had a similar problem? Maybe there is a way to fix these imperfections.