正在检查Asp上Razor页面中的登录用户AuthorizePolicy。核心业务净额

这似乎与提出的问题类似 here

我找到了这个可能有用的链接: https://docs.asp.net/en/latest/security/authorization/views.html

该页面中的示例:

@if (await AuthorizationService.AuthorizeAsync(User, "PolicyName"))
{
    <p>This paragraph is displayed because you fulfilled PolicyName.</p>
}

在某些情况下,资源将是您的视图模型,您可以调用 AuthorizeAsync的方式与您在 基于资源的授权;

@if (await AuthorizationService.AuthorizeAsync(User, Model, Operations.Edit))
{
    <p><a class="btn btn-default" role="button"
    href="@Url.Action("Edit", "Document", new {id= Model.Id})">Edit</a></p>
}

使用Dot-net core 2.0 AuthorizationService。AuthorizeAsync不再返回布尔值,而是返回AuthorizationResult。dot-net core 2.0的工作版本如下:

@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

@if ((await AuthorizationService.AuthorizeAsync(User, "RequireAuthenticatedUser")).Succeeded)
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}

因此,完整视图包含:

@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

// Your HTML elements and i.e.:
@if (await AuthorizationService.AuthorizeAsync(User, "RequireAuthenticatedUser"))
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}

更简洁地说:

@inject Microsoft.AspNetCore.Authorization.IAuthorizationService authorizationService

@if (await authorizationService.AuthorizeAsync(User, null, "RequireAuthenticatedUser"))
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}

它出现了 AuthorizeAsync() 需要resource参数,但可以像我的示例一样传递null。

如果要在许多视图中使用它,那么最好实现一个自定义 剃刀页面 :

public abstract class MyRazorPage<T> : RazorPage<T>
{
    public async Task<bool> HasPolicyAsync(string policyName)
    {
        var authorizationService = Context.RequestServices.GetService(typeof(IAuthorizationService)) as IAuthorizationService;
        bool isAdmin = (await authorizationService.AuthorizeAsync(User, policyName)).Succeeded;
        return isAdmin;
    }
}

然后打开 _查看导入.cshtml 并添加下一条指令:

@inherits MyRazorPage<TModel>

现在你可以打电话了 HasPolicyAsync() 方法:

    if (await HasPolicyAsync(Policies.RequireAdmin))
    {
        <h2>Admin is authorized</h2>
    }

它看起来会简洁得多。

目前,在大多数情况下,最好使用TagHelper进行处理。 您可以这样使用它:

<li policy="@MyGroups.Administrators">
....

所以不再使用魔法字符串:-)

请参见: https://www.davepaquette.com/archive/2017/11/05/authorize-tag-helper.aspx