在Blazor中,我们可以使用Guard进行路由保护,防止已验证用户访问需要身份验证的页面。我们需要在启动文件中配置Guard,然后在需要保护的路由中使用AuthorizeRouteView组件。
以下是实现此目的的代码示例:
public void ConfigureServices(IServiceCollection services)
{
services.AddAuthorizationCore();
services.AddScoped();
services.AddScoped();
services.AddSingleton();
}
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
endpoints.MapBlazorHub();
endpoints.MapFallbackToPage("/_Host");
});
}
在此示例中,我们在服务中添加了AuthorizationCore和CustomAuthorizationPolicyProvider,它们将用于自定义AuthorizationPolicy。接下来,我们在各自的Authorization Handler中添加了HasPermissionHandler和PermissionAuthorizationHandler。
public class CustomAuthorizationPolicyProvider : IAuthorizationPolicyProvider
{
private readonly AuthorizationOptions _options;
public CustomAuthorizationPolicyProvider(IOptions options)
{
_options = options.Value;
}
public Task GetPolicyAsync(string policyName)
{
foreach (var policy in _options.Policies)
{
if (policy.Name == policyName)
{
return Task.FromResult(policy);
}
}
return Task.FromResult(null);
}
public Task GetDefaultPolicyAsync()
{
return Task.FromResult(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build());
}
}
此类指定默认策略为Authenticated User。
public class HasPermissionHandler : AuthorizationHandler
{
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HasPermissionRequirement requirement)
{
var permissionClaim = context