I have an ASP.NET Core 7 MVC project that has layout that looks like this.
Default URL will be https://myurl/Home.
My question is: when I click any menu at left tab to navigate to the page, what is the differences/concerns/security issues when using:
https://myurl/UserProfile)Ajax is used to make up for disadvantages. But in your requirement, I will use Directly route to the menu URL if I were you, because it is used for this scenario.
When we want to submit data in an MVC project but don't use Ajax, form submitting is normally used. When using form submitting, we have to submit all the form elements, it's synchronous, and it will return the whole page. Using Ajax will make the the progress asynchronous, and only the required data would be send the returned, so that the performance shall be better(less data is transferred).
In the meantime, when we use Ajax to send request, the current page is still responsible, if the response is required to update the current page, the update shall be seamless. By the way, using ajax allow us to access external resources easily, we just need to define the url and parameter, comparing with form, set controller and action brings much trouble and restrict.
However, when we want to switch between different navigation menus, we already have menu button in the layout, it has no effect on data transferring, we just want to open another page, <a href="/xx"> is enough. Therefore, using Directly route should be the best option here. AJAX call to modify the html partial view sounds like to recognize all pages as partial views and put required partial views into the only main page, I think this will bring maintaining issue in the future.
In the security field, ajax and navigation routing have no difference. When we take security issue into consideration, we always think about http and https which are based on Transport Layer Protocol TCP/IP. Ajax and navigation routing are Application Layer, in this layer, we might do some actions like monitoring and prohibiting Develop mode in Browser so that we could prevent users to change js and html content.