Blazor WASM authorize attribute based on query string

Question

@attribute [Authorize(Roles = "Admin")]
@attribute [Authorize(Roles = NavigationManager.QueryString("level"))]

I have added this code on my page level, the first authorize attribute works fine, since it is just a constant value "Admin" but not the second authorize attribute.

I am trying to grant access based on the query string, but this code NavigationManager.QueryString("level") will have this error "An object reference is required for the nonstatic field, method, or property 'member'"

https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-messages/cs0120?f1url=%3FappId%3Droslyn%26k%3Dk(CS0120)

Is there anyway to fix this?

Answer 1

Short answer: you cannot do this. An attribute argument needs to be a compile time constant .

Long answer: don't do this. Checking for authorization using query string is inherently unsecure.

If you have complicated authorization, check out Policy based authorization. This is a good explainer in general. Check out this for a more Blazor WASM specific example