I have a Blazor WASM app, and I'm trying to use a custom authorization attribute/handler rather than the built-in [Authorize] one. I'm following the same approach that I used to secure a Minimal API based app, but that does not seem to work here.
I have an AuthConfiguration that is setting up the policy like so:
public static class AuthConfiguration{ public static void AddAuthorizationPolicies(this IServiceCollection services) { var policy = BuildPolicy(); services.AddAuthorizationCore(options => { options.AddPolicy(RequiredPermissionDefaults.PolicyName, policy); options.FallbackPolicy = policy; }); services.TryAddEnumerable(ServiceDescriptor.Singleton<IAuthorizationHandler, RequiredPermissionAuthorizationHandler>()); } private static AuthorizationPolicy BuildPolicy() { return new AuthorizationPolicyBuilder() .RequireAuthenticatedUser() .RequireRequiredPermissions() .Build(); }}public static class RequiredPermissionDefaults{ public const string PolicyName = "RequiredPermission";}public static class RequiredPermissionAuthorizationExtensions{ public static AuthorizationPolicyBuilder RequireRequiredPermissions(this AuthorizationPolicyBuilder builder) { return builder.AddRequirements(new PermissionAuthorizationRequirement()); }}Where the attribute is defined like this:
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]public class RequiredPermissionAttribute(Permission[] permissions, LogicalOperator logicalOperator = LogicalOperator.And) : Attribute, IRequiredPermissionMetadata{ public Permission[] Permissions { get; } = permissions; public string LogicalOperator { get; } = logicalOperator.ToString();}I'm trying to use it in the Razor page like this:
@page "/global-tasks"@attribute [RequiredPermission([Permission.ViewUsers])]However, this does not trigger the custom IAuthorizationHandler and instead just uses the default authorization. I've been searching around for documentation, but I've not come across anything that mentions creating a new authorization attribute and using it in the manner that I am. Is this possible?