Authorization In Razor Pages ASP.NET Core

Introduction

Authorization is a process that determines what a user is able to do. For example, an Admin user is allowed to install/remove software from a computer and a non-Admin user can use the software from the computer. It is independent and orthogonal from authentication. However, authorization requires an authentication mechanism. For applications, the first step is always authentication and then authorization.

Using AuthorizeFilter, we can control the access in our MVC / Web API application by specifying this attribute in the controller or action method. Similarly, there is a way to control access in our Razor pages, i.e., to use authorization conventions at startup. These conventions allow us to authorize users to access individual pages or folders of the pages. In the same way, these conventions allow anonymous users to access individual pages or folders of pages.

To demonstrate the concept, I have created an application with ASP.NET Core Identity. For guidance on how to create an application with ASP.NET Core Identity, please refer to my article "Overview Of Identity In ASP.NET Core 2.0".

Using AddRazorPagesOptions, we can add an AuthorizeFilter to the page at the specified path. With AddRazorPagesOptions, we have a couple of methods that can be used to authorize or allow anonymous access to the page or folder.

AuthorizePage

This adds an AuthorizeFilter to the specified page. There are two extension methods: one is "to accept the page name" and the other one is " to accept the page name and authorization policy".

public static PageConventionCollection AuthorizePage(
    this PageConventionCollection conventions, 
    string pageName)    
public static PageConventionCollection AuthorizePage(
    this PageConventionCollection conventions, 
    string pageName, 
    string policy)

AuthorizeFolder

This adds AuthorizeFilter to all pages under a specified folder. There are two extension methods - accept the folder path, and accept the folder path and authorization policy.

public static PageConventionCollection AuthorizeFolder(this PageConventionCollection conventions, string folderPath)  
public static PageConventionCollection AuthorizeFolder(this PageConventionCollection conventions, string folderPath, string policy)  

AllowAnonymousToPage

This adds AllowAnonymousFilter to the specified page.

public static PageConventionCollection AllowAnonymousToPage(
    this PageConventionCollection conventions, 
    string pageName)

AllowAnonymousToFolder

This adds AllowAnonymousFilter to all the pages under the specified folder.

public static PageConventionCollection AuthorizeAreaPage(
    this PageConventionCollection conventions, 
    string areaName, 
    string pageName)
{
    // Implementation code here
}

public static PageConventionCollection AuthorizeAreaPage(
    this PageConventionCollection conventions, 
    string areaName, 
    string pageName, 
    string policy)
{
    // Implementation code here
}

AuthorizeAreaPage

This is the same as the AuthorizePage method. It adds AuthorizeFilter to the specified page under the specified Area. It also has an extension method that accepts the authorization policy.

public static PageConventionCollection AuthorizeAreaPage(
    this PageConventionCollection conventions, 
    string areaName, 
    string pageName)
{
    // Method implementation here
}

public static PageConventionCollection AuthorizeAreaPage(
    this PageConventionCollection conventions, 
    string areaName, 
    string pageName, 
    string policy)
{
    // Method implementation here
}