重定向到Blazor WebAssembly中的403 Forbidden组件

问题描述

我目前正在开发 .NET Standard 2.1 Blazor WebAssembly托管应用程序。

在我的身份验证方案中，我使用用户角色。

如果用户没有角色，即 Admin 。我想将所有用户重定向到<ForbiddenView />。

最好在应用程序中的一个地方进行处理。

• 我的App.razor看起来像这样：

   <CascadingAuthenticationState>
        <Router AppAssembly="@typeof(Program).Assembly">
            <Found Context="routeData">
                <AuthorizeRouteView RouteData="@routeData">
                    <Authorizing>
                        <p>Authorizing...</p>
                    </Authorizing>
                    <NotAuthorized>
                        @if (!context.User.Identity.IsAuthenticated)
                        {
                           // User is not authenticated - forward to login view
                            <LoginView />
                        }
                        else if(context.User.Identity.IsAuthenticated && context.User.Identity.notinRole) // .notinRole does not exist!!
                        {
                            // 403 - User is authenticated,but not in a specific role i.e. admin to view a page in my app. The server understood the request,but is refusing to fulfill it.
                            <ForbiddenView />
                        }
                        else
                        {
                           // 401 - Login of my user happend - the request already includes Authorization credentials.
                            <NotAuthorizedView />
                        }
                    </NotAuthorized>
                </AuthorizeRouteView>
            </Found>
            <NotFound>
                <NotFoundView />
            </NotFound>
        </Router>
    </CascadingAuthenticationState>

您知道如何集中处理Blazor WebAssembly中的403错误吗？

您对如何处理Blazor WebAssembly上的403错误有任何建议吗？

解决方法

尝试在不同的上下文中使用AuthorizeView：

<CascadingAuthenticationState>
    <Router AppAssembly="@typeof(Program).Assembly">
        <Found Context="routeData">
            <AuthorizeRouteView RouteData="@routeData">
                <Authorizing>
                    <p>Authorizing...</p>
                </Authorizing>
                <NotAuthorized>
                    <AuthorizeView Context="authenticated">
                        <Authorized Context="authenticated">
                            <AuthorizeView Roles="WhatEver" Context="role">
                                <Authorized Context="role">
                                    <NotAuthorizedView />
                                </Authorized>
                                <NotAuthorized Context="role">
                                    <ForbiddenView />
                                </NotAuthorized>
                            </AuthorizeView>
                        </Authorized>
                        <NotAuthorized Context="authenticated">
                            <RedirectToLogin />
                        </NotAuthorized>
                    </AuthorizeView>
                </NotAuthorized>
            </AuthorizeRouteView>
        </Found>
        <NotFound>
            <NotFoundView />
        </NotFound>
    </Router>
</CascadingAuthenticationState>

或!context.User.IsInRole("WhatEver");

如果您特别需要NotInRole：

public static bool NotInRole(this ClaimsPrincipal claimsPrincipal) 
    => claimsPrincipal.Claims.All(c => c.Type != "role");