dotnet / dotnet/aspnetcore

Add a DefaultPolicy property on AuthorizeRouteView to be used when no Policies are set on a component

Open
#50,111 2 comments 2 reactions 0 assignees View on GitHub
area-auth enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Assume I have a requirement that forces people to enable 2FA when it's not enabled.
I want users not to be able to access anything in the Blazor application except the page where the user can Enable 2FA.
So instead of setting an authorization policy on all pages except the "Enable 2FA page," I would like the reverse.
Adding a default policy to pages that have no authorization policies set.

### Describe the solution you'd like

By adding
```cs
[Parameter] public IAuthorizeData[]? DefaultPolicy { get; set; }
```
To the ``AuthorizeRouteView`` component

and cascading that down to

```cs
private static IAuthorizeData[]? ComputeAuthorizeDataForType(Type type, IAuthorizeData[]? defaultPolicy)
{
//...
return authorizeDatas?.ToArray() ?? defaultPolicy;
}
```
the ``DefaultPolicy`` could be used for all components that have no``IAuthorizeData`` set. This reduces the risk of not setting a "default" policy on a page

The alternative is to set a Policy on all components except the page you need to enable that requirement (in my example the "Enable 2FA page")

The other alternative is to create a custom ``AuthorizeRouteView`` component that implements this feature (this is the route I have gone so far)

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.