Quantcast
Channel: Active questions tagged blazor - Stack Overflow
Viewing all articles
Browse latest Browse all 4839

Custom authorization attribute/handler with Blazor WASM

$
0
0

I have a Blazor WASM app, and I'm trying to use a custom authorization attribute/handler rather than the built-in [Authorize] one. I'm following the same approach that I used to secure a Minimal API based app, but that does not seem to work here.

I have an AuthConfiguration that is setting up the policy like so:

public static class AuthConfiguration{    public static void AddAuthorizationPolicies(this IServiceCollection services)    {        var policy = BuildPolicy();        services.AddAuthorizationCore(options =>        {            options.AddPolicy(RequiredPermissionDefaults.PolicyName, policy);            options.FallbackPolicy = policy;        });        services.TryAddEnumerable(ServiceDescriptor.Singleton<IAuthorizationHandler, RequiredPermissionAuthorizationHandler>());    }    private static AuthorizationPolicy BuildPolicy()    {        return new AuthorizationPolicyBuilder()            .RequireAuthenticatedUser()            .RequireRequiredPermissions()            .Build();    }}public static class RequiredPermissionDefaults{    public const string PolicyName = "RequiredPermission";}public static class RequiredPermissionAuthorizationExtensions{    public static AuthorizationPolicyBuilder RequireRequiredPermissions(this AuthorizationPolicyBuilder builder)    {        return builder.AddRequirements(new PermissionAuthorizationRequirement());    }}

Where the attribute is defined like this:

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]public class RequiredPermissionAttribute(Permission[] permissions, LogicalOperator logicalOperator = LogicalOperator.And)    : Attribute, IRequiredPermissionMetadata{    public Permission[] Permissions { get; } = permissions;    public string LogicalOperator { get; } = logicalOperator.ToString();}

I'm trying to use it in the Razor page like this:

@page "/global-tasks"@attribute [RequiredPermission([Permission.ViewUsers])]

However, this does not trigger the custom IAuthorizationHandler and instead just uses the default authorization. I've been searching around for documentation, but I've not come across anything that mentions creating a new authorization attribute and using it in the manner that I am. Is this possible?


Viewing all articles
Browse latest Browse all 4839

Trending Articles