asp.net core razor use of role in view

C# Corner

Marius Vasile

5y761.NET

I want to be able to give users access to view sections of the View and I can do that with

@if (Model.UserDataRole.RoleName == "Issuer")
{
//some divs here
}

and if

@if (Model.UserDataRole.RoleName == "Admin")
{
//other divs here
}

My questions, is it safe to do so or I should try to do it in the cshtml.cs instead?

6 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sachin Singh5y ago
Accepted answer
use partial view in razor and bind your partialview with viewmodel (Mydata (in below example))
public class PartialDemoModel : PageModel
    {


        public void OnGet()
        {
if(UserDataRole.RoleName == "Issuer")
{
  //retrieve user related data
   mydata.user u=new user();
    u.Name="user";
.....

}

else {
  retrieve Admin related data

   Mydata.Admin a=new Admin();
a.name="Admin";

}
        }
    }

....razor......
    @page
    @model MyData
    @{
    }
    "_Partial1" model="Model.MyData" />



....partial view......
    @model MyData
       if (Model.UserDataRole.RoleName == "Issuer")
        {
            model.User.Name
            //some divs here
        }



    @if (Model.UserDataRole.RoleName == "Admin")
        {
              model.Admin.Name
            //other divs here
        }
......model.....
public class MyData
{
public User user{get;set;}  //  user class
public Admin admin{get;set;}  // admin class
public userdataRole role {get;set;}  // role class
}
+1
Sachin Singh5y ago
yes looks safe now but on inspect they still can see both data.
+1
Marius Vasile5y ago
Yeah, partialView is a very good one as well
+1
Marius Vasile5y ago
So I used
var userId = User.FindFirstValue(ClaimTypes.NameIdentifier);
            var userRole = await _context.UserRoles.Where(x => x.UserId == userId).SingleOrDefaultAsync();

            var myS = "Receiver";
            UR = userRole.Equals(myS);
and in View
@if (Model.UR == true)
    {
        class="col-12">
            class="col-6">
                class="btn btn-link border border-success">ACCEPT
class="col-6">
class="btn btn-link border border-danger">REJECT

}

Safe now?

Marius Vasile5y ago

Thank you Sachin, so I can use some "fake "Models then to achieve the same result, or use a Count. Because I don't know how to achieve that from cshtml.cs but only to give access or not to the whole page. portions of the page....I don't know how

Sachin Singh5y ago

obviously unsafe ,you are exposing roles to outside world, anybody can inspect and know.

sure do it in cshtml.cs.