Blazor @attribute [Authorize] 標簽不起作用

Question

我有一個工作 .NET Core 3.0 MVC 網站，使用 AzureAD 進行身份驗證，這一切都很好。 我已經開始將一些前端頁面遷移到 Blazor（在同一個項目中），但無法使身份驗證工作。

I have added the @attribute [Authorize] tag to the top of Index.razor but I do not get redirected to Azure to login as I would do when adding it to a standard ASP.NET MVC Controller.

啟動.ConfigureServices

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect(options =>
{
    Configuration.GetSection("OpenIdConnect").Bind(options);
});
services.AddAuthorizationCore(options =>
{
    options.AddPolicy(Policies.AccessRole, Policies.IsAccessPolicy());
    options.AddPolicy(Policies.AdminRole, Policies.IsAdminPolicy());
});

啟動.配置

app.UseAuthentication();
app.UseAuthorization();

索引.razor

@page "/"
@attribute [Authorize(Policy = Policies.AccessRole)]

政策

public static class Policies
{
    public const string AccessRole = "Access";
    public const string AdminRole = "Admin";

    public static AuthorizationPolicy IsAccessPolicy()
    {
        return new AuthorizationPolicyBuilder().RequireAuthenticatedUser()
                                               .RequireRole(AccessRole)
                                               .Build();
    }

    public static AuthorizationPolicy IsAdminPolicy()
    {
        return new AuthorizationPolicyBuilder().RequireAuthenticatedUser()
                                               .RequireRole(AdminRole)
                                               .Build();
    }
}

如果我導航到 MVC 頁面，我將通過 AzureAD 進行身份驗證，如果我隨后返回 Blazor 頁面，我可以成功使用以下內容

<AuthorizeView Policy="@Policies.AccessRole">
    <p>Is in Access policy.</p>
</AuthorizeView>

<AuthorizeView Policy="@Policies.AdminRole">
    <p>Is in Admin policy.</p>
</AuthorizeView>

總而言之，我的 Blazor 頁面在使用 [Authorize] 屬性時不會自動發出身份驗證質詢。

有誰知道我做錯了什么？

更新

按照設計https://github.com/aspnet/AspNetCore/issues/13709

作為一種解決方法，我添加了一個組件以重定向到登錄頁面

App.razor

<Router AppAssembly="@typeof(Program).Assembly">
    <Found Context="routeData">
        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
            <NotAuthorized>
                <AuthChallenge></AuthChallenge>
            </NotAuthorized>
        </AuthorizeRouteView>
    </Found>
    <NotFound>
        <CascadingAuthenticationState>
            <LayoutView Layout="@typeof(MainLayout)">
                <p>Sorry, there's nothing at this address.</p>
            </LayoutView>
        </CascadingAuthenticationState>
    </NotFound>
</Router>

AuthCallenge.razor

@inject NavigationManager Navigation

@code {
    protected override void OnInitialized()
    {
        Navigation.NavigateTo("/Account/SignIn", true);
    }
}

Answer 1

查看您的 App.razor 文件。 你使用 RouteView 還是 AuthorizeRouteView？

您需要按照“ASP.NET Core Blazor 身份驗證和授權”頁面中的說明定義 AuthorizeRouteView。

<Router AppAssembly="@typeof(Program).Assembly">
<Found Context="routeData">
    <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
        <NotAuthorized>
            <h1>Sorry</h1>
            <p>You're not authorized to reach this page.</p>
            <p>You may need to log in as a different user.</p>
        </NotAuthorized>
        <Authorizing>
            <h1>Authentication in progress</h1>
            <p>Only visible while authentication is in progress.</p>
        </Authorizing>
    </AuthorizeRouteView>
</Found>
<NotFound>
    <CascadingAuthenticationState>
        <LayoutView Layout="@typeof(MainLayout)">
            <h1>Sorry</h1>
            <p>Sorry, there's nothing at this address.</p>
        </LayoutView>
    </CascadingAuthenticationState>
</NotFound>

如果缺少該組件，似乎 AuthorizeAttribute 並沒有做那么多。

Answer 2

您必須在 XML 中以 root 身份使用 CascadingAuthenticationState

<CascadingAuthenticationState>
    <Router AppAssembly="@typeof(Program).Assembly">
        <Found Context="routeData">
            <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(EmptyLayout)">
                <NotAuthorized>
                    <RedirectLogin />
                </NotAuthorized>
            </AuthorizeRouteView>
        </Found>
        <NotFound>
            <LayoutView Layout="@typeof(MainLayout)">
                <h1>404 Error</h1>
                <p>Sorry, there's nothing at this address.</p>
            </LayoutView>
        </NotFound>
    </Router>
</CascadingAuthenticationState>