I created asp.net core with react.js template in VS 2019
It seems to use AuthRouter compoent in react.js to authorize the page
As far as i understand react.js is actually running on client-side (Doesn't the web server deploy the built react.js file?)
Doesn't that have a risk?
Doesn't asp.net core need authentication on the server side to deploy react.js files?
As far as i understand react.js is actually running on client-side
Correct. React apps are typically build as SPAs (single page applications) where we have a JS app running in the browser and an api app (c#) running on server side.
(Doesn't the web server deploy the built react.js file?)
"Deploy" typically means "bring something to (production) server". So, no your server does not "deploy" the js file but it "serves" or "delivers" the js app. (it brings it from server to your users web browser).
Doesn't that have a risk?
Your JS app schould not contain any sensitive information in it' source code. It should fetch data from your server's api. So no, just delivering the app is no problem.
Doesn't asp.net core need authentication on the server side to deploy react.js files?
It's not the react.js file that needs to be protected (typically) but the data that app reads from or writes to your server api.
You need to check authorization twice for SPAs:
