在Asp.Net Core的Razor页面中检查登录用户AuthorizePolicy

Question

我正在寻找一个变种

@if (SignInManager.IsSignedIn(User) && User.IsInRole(Roles.Administrator))
{
    <div id="editArticle">

但是不是在检查完政策之后检查角色,而是像在控制器中那样检查.

[Authorize(Policy = Policies.RequireAdmin)]

Answer 1

这似乎与这里提出的问题相似

我发现此链接可能会有所帮助:https://docs.asp.net/en/latest/security/authorization/views.html

该页面的示例:

@if (await AuthorizationService.AuthorizeAsync(User, "PolicyName"))
{
    <p>This paragraph is displayed because you fulfilled PolicyName.</p>
}

在某些情况下,资源将是您的视图模型,您可以使用与在基于资源的授权期间检查的方式完全相同的方式调用AuthorizeAsync;

@if (await AuthorizationService.AuthorizeAsync(User, Model, Operations.Edit))
{
    <p><a class="btn btn-default" role="button"
    href="@Url.Action("Edit", "Document", new {id= Model.Id})">Edit</a></p>
}

Answer 2

使用Dot net core 2.0 AuthorizationService.AuthorizeAsync不再返回布尔值,它返回AuthorizationResult.dot net core 2.0的工作版本将是这样的:

@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

@if ((await AuthorizationService.AuthorizeAsync(User, "RequireAuthenticatedUser")).Succeeded)
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}

Answer 3

因此，完整的视图包含：

@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

// Your HTML elements and i.e.:
@if (await AuthorizationService.AuthorizeAsync(User, "RequireAuthenticatedUser"))
{
     <li><a asp-area="" asp-controller="Roles" asp-action="Index">Roles</a></li>
}