dotnet / dotnet/aspnetcore

AuthorizeView should expose the results of the AuthorizeAsync call as a context variable.

Open
#43,959 11 comments 6 reactions 0 assignees View on GitHub
area-blazor enhancement good first issue help wanted
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I am using [asp.net Policy](https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-6.0) to enforce licensing restrictions. When a user is not authorized to view or use a component I want to be able to tell them _why_ they are not authorized. This is supported via Policy, where you can include a reason why access is denied that then shows up in the [AuthorizationResult](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authorization.authorizationresult?view=aspnetcore-6.0) as a [AuthorizationFailureReason](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authorization.authorizationfailurereason?view=aspnetcore-6.0). AuthorizeViewCore, however, throws away all this metadata and boils the result down to a true/false for which view to show.

### Describe the solution you'd like

I wrote a custom AuthorizeViewCore that wraps the AuthenticationState and the AuthorizationResult in a new type, and makes that available as a context variable. Now my NotAuthorized view can show a tooltip or other message indicating why it's not authorized (ex. "this is disabled because you are not licensed for this feature").

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.