Checking login user AuthorizePolicy in Razor page on Asp.Net Core

Question

I'm looking for a variant of this

@if (SignInManager.IsSignedIn(User) && User.IsInRole(Roles.Administrator))
{
    <div id="editArticle">

but instead of checking after the role I'm after a check into the policy much like you would in a controller by doing this.

[Authorize(Policy = Policies.RequireAdmin)]

score 23 · Accepted Answer · edited May 23 '17 at 12:10

23

This seems similar to question asked here

I found this link which may be helpful: https://docs.asp.net/en/latest/security/authorization/views.html

Examples from that page:

@if (await AuthorizationService.AuthorizeAsync(User, "PolicyName"))
{
    <p>This paragraph is displayed because you fulfilled PolicyName.</p>
}

In some cases the resource will be your view model, and you can call AuthorizeAsync in exactly the same way as you would check during resource based authorization;

@if (await AuthorizationService.AuthorizeAsync(User, Model, Operations.Edit))
{
    <p><a class="btn btn-default" role="button"
    href="@Url.Action("Edit", "Document", new {id= Model.Id})">Edit</a></p>
}

edited May 23 '17 at 12:10

Community

1
1

answered May 29 '16 at 17:35

James P

2,003
2
17
27

11

This is just great. :D For the next one looking for this you need `@using Microsoft.AspNetCore.Authorization` and `@inject IAuthorizationService AuthorizationService` aswell – Thomas Andreè Wang May 29 '16 at 17:56
@Thomas Thanks for putting the using... clause into this answer, MS forgot that important bit of info in their docs. – JReam Feb 21 '17 at 20:42
@JReam hehe yea i just wished that people would upvote the question instead of the comment :P – Thomas Andreè Wang Feb 22 '17 at 10:02
1

In all these anwsers only the @Talnaci Sergiu Vlad´s anwser works. – Just Fair Oct 01 '18 at 05:29

score 20 · Answer 2 · answered Aug 25 '17 at 11:42

With Dot net core 2.0 AuthorizationService.AuthorizeAsync no longer returns a boolean, it returns a AuthorizationResult. A working version for dot net core 2.0 will be something like this:

@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

@if ((await AuthorizationService.AuthorizeAsync(User, "RequireAuthenticatedUser")).Succeeded)
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}

score 5 · Answer 3 · answered Feb 21 '17 at 17:59

Therefore the complete view contains:

@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

// Your HTML elements and i.e.:
@if (await AuthorizationService.AuthorizeAsync(User, "RequireAuthenticatedUser"))
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}

Sergey · Answer 4 · 2018-02-14T18:36:41.147

If you're going to use this in many views, then you'd better implement a custom RazorPage:

public abstract class MyRazorPage<T> : RazorPage<T>
{
    public async Task<bool> HasPolicyAsync(string policyName)
    {
        var authorizationService = Context.RequestServices.GetService(typeof(IAuthorizationService)) as IAuthorizationService;
        bool isAdmin = (await authorizationService.AuthorizeAsync(User, policyName)).Succeeded;
        return isAdmin;
    }
}

then open _ViewImports.cshtml and add the next instruction:

@inherits MyRazorPage<TModel>

now you can call HasPolicyAsync() method from any view:

    if (await HasPolicyAsync(Policies.RequireAdmin))
    {
        <h2>Admin is authorized</h2>
    }

It would look much more concise.

score 1 · Answer 5 · answered Feb 25 '21 at 13:35

1

Its best handled with TagHelpers in most scenarios now. You can use it like:

<li policy="@MyGroups.Administrators">
....

So no longer Magicstrings :-)

See: https://www.davepaquette.com/archive/2017/11/05/authorize-tag-helper.aspx

answered Feb 25 '21 at 13:35

Peter Bucher

25
7

score 0 · Answer 6 · answered Jul 19 '17 at 11:10

To put it even more succinctly:

@inject Microsoft.AspNetCore.Authorization.IAuthorizationService authorizationService

@if (await authorizationService.AuthorizeAsync(User, null, "RequireAuthenticatedUser"))
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}

It appears AuthorizeAsync() requires the resource parameter, but null can be passed as in my example.

Checking login user AuthorizePolicy in Razor page on Asp.Net Core

6 Answers6

Linked