[Blazor] Custom Authorization analog of Authorize attribute

[mikermnv]

Problem Statement

When implementing a custom permission checking system in a Blazor Server project, I encountered difficulties creating a universal solution that requires minimal code and allows protecting resource components.

Desired Flow

1. While permissions are being checked → show a loader.
2. After the check:
   • If access is granted → render the protected body content.
   • If access is denied → render a fragment with a message about missing rights.

This is similar to the built-in [Authorize] attribute for components and the AuthorizeView wrapper for static UI elements.
I was able to implement an AuthorizeView-like wrapper, but creating an Authorize-like attribute proved problematic.

---

Issues Encountered

1. Authorize Attribute Limitations
   • Cannot render a custom fragment when access is denied (e.g., message with missing rights).
   • Cannot easily pass parameters such as a list of required permissions and a custom context model

public class SecurityContext 
{
    public int? ProjectId { get; set; }
    public int? DepartmentId { get; set; }
}

The problem is that SecurityContext in dynamicly set from url, but attribute can contains only static info. So it is not an option.
2. Layout Approach

• Attempted to use multiple layouts to handle authorization states, but Blazor only supports a single layout per page.

3. Inheritance Approach
   • Implemented a base component (SecurityComponentBaseCore + SecurityComponentBase) that handles loading, access checks, and error messages.

Example: SecurityComponentBaseCore.razor

@if (Loading)
{
    <FluentStack HorizontalAlignment="HorizontalAlignment.Center" VerticalAlignment="VerticalAlignment.Center" Style="height: 100%">
        <FluentProgressRing style="width: 62px; height: 62px;" />
    </FluentStack>
}
else if (HasAccess)
{
    @Body
}
else
{
    <FluentMessageBar Intent="MessageIntent.Warning">@ErrorMessage</FluentMessageBar>
}

@code {
    public virtual bool Loading { get; set; } = true;
    public virtual bool HasAccess { get; set; } = false;
    public virtual string ErrorMessage { get; set; } = string.Empty;
    private protected virtual RenderFragment Body => builder => { };
}

Example: SecurityComponentBase.cs

public abstract class SecurityComponentBase : SecurityComponentBaseCore
{
    [Inject] protected ISecurityManager SecurityManager { get; set; } = default!;
    [Inject] protected ILogger<SecurityComponentBase> Logger { get; set; } = default!;

    protected virtual SecurityContext Context { get; } = new SecurityContext();
    protected virtual List<string> RequiredPermissions { get; } = [];

    private protected sealed override RenderFragment Body => BuildRenderTree;
    protected new virtual void BuildRenderTree(RenderTreeBuilder builder) { }

    protected override async Task OnInitializedAsync()
    {
        try
        {
            Loading = true;
            var res = await SecurityManager.HasAccess(Context, RequiredPermissions);

            HasAccess = res.IsSuccess;
            Loading = false;
            if (!HasAccess)
            {
                ErrorMessage = res.ErrorMessage ?? "Access denied";
            }
        }
        catch (Exception ex)
        {
            Logger.LogError(ex, "Error checking permissions");
            HasAccess = false;
            ErrorMessage = "Error checking permissions";
        }
        finally
        {
            Loading = false;
        }
    }
}

Example: MyComponent.razor

@inherits SecurityComponentBase

<div>
    content
</div>

@code {
    protected override List<string> RequiredPermissions { get; } = ["right1", "right2"];
    protected override SecurityContext Context { get; } = new SecurityContext { ProjectId = 1 };

    protected override async Task OnInitializedAsync()
    {
        await base.OnInitializedAsync();
        // Secure work here
        await Task.Delay(5000);
    }
}

The problem in this scenario is that calling StateHasChanged() anywhere results in:

System.NullReferenceException: 'Object reference not set to an instance of an object.'

This prevents showing the loader only during permission checks (instead it persists until the entire OnInitializedAsync of the derived component finishes and a 5‑second delay allows this to be shown). The call to StateHasChanged() is necessary in this scenario because it should trigger a re‑render: once the permission check completes, the component should update its UI so that the loader is replaced by either the protected content or the denied fragment. Without this re‑render, the loader remains visible longer than intended.

---

Question

Is there a proper Blazor solution that allows building an Authorize-like mechanism with:

• A loader displayed during the permission check
• A custom denied fragment that shows missing rights
• The ability to pass both a list of required permissions and a context model (SecurityContext)

Is there a recommended pattern or framework support for this scenario?
Alternatively, could the existing Authorize attribute be extended or modified to handle these requirements?

Attempting to implement something that was not originally intended feels fragile, especially since Blazor evolves quickly and such a workaround may stop functioning in future versions (I have already experienced this).

Therefore, the core question is: Is there a proper, supported way to create an equivalent of Authorize or a reworked version that will reliably function in Blazor?

It is possible that I have not fully understood all aspects of Blazor’s authorization system and may be missing something important. I would be glad to read any comments, clarifications, or suggestions.

[javiercn]

@mikermnv thanks for contacting us.

I think Blazor already supports this. Here is an alternative approach you can try:

1. Create a Requirement and Handler

// PermissionRequirement.cs
public class PermissionRequirement : IAuthorizationRequirement
{
    public string[] Permissions { get; }
    public PermissionRequirement(params string[] permissions) => Permissions = permissions;
}

// PermissionHandler.cs
public class PermissionHandler : AuthorizationHandler<PermissionRequirement>
{
    private readonly ISecurityManager _securityManager;

    public PermissionHandler(ISecurityManager securityManager)
        => _securityManager = securityManager;

    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        PermissionRequirement requirement)
    {
        int? projectId = null;
        int? departmentId = null;

        var securityContext = Resource is SecurityContext secContext ?
            secContext :
            Resource is HttpContext httpContext ? CreateFromContext(httpContext) :
            null;
       
       SecurityContextResult result = false;
            if (securityContext != null)
            {
                result = await _securityManager.HasAccess(securityContext, requirement.Permissions.ToList());
            }
                
        if (result)
            context.Succeed(requirement);
        } else {
            ...
        }
    }
}

2. Register Handler and Policies

// Program.cs
builder.Services.AddScoped<IAuthorizationHandler, PermissionHandler>();

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ProjectRead", policy =>
        policy.Requirements.Add(new PermissionRequirement("project.read")));
    options.AddPolicy("ProjectEdit", policy =>
        policy.Requirements.Add(new PermissionRequirement("project.read", "project.edit")));
});

3. Configure AuthorizeRouteView with Resource

The key is passing routeData as the Resource so the handler can access route parameters:

@* Routes.razor *@
<Router AppAssembly="typeof(Program).Assembly">
    <Found Context="routeData">
        <AuthorizeRouteView Resource="routeData" RouteData="routeData" DefaultLayout="typeof(MainLayout)">
            <Authorizing>
                <LoadingSpinner />
            </Authorizing>
            <NotAuthorized>
                @if (!context.User.Identity?.IsAuthenticated ?? true)
                {
                    <RedirectToLogin /> @* 401 - Not authenticated *@
                }
                else
                {
                    <AccessDenied /> @* 403 - Forbidden *@
                }
            </NotAuthorized>
        </AuthorizeRouteView>
    </Found>
</Router>

4. Use on Pages

@page "/projects/{ProjectId:int}"
@attribute [Authorize(Policy = "ProjectRead")]

<h1>Project Details</h1>

@code {
    [Parameter] public int ProjectId { get; set; }
}

The code above is a sketch, please review the relevant authorization docs and to ensure proper handling of all the 3 cases (succeed, failure, requirement doesn't apply)

[mikermnv]

@javiercn First, thank you for your response. Unfortunately, this solution is not working correctly.

I don’t understand why, if I pass a Microsoft.AspNetCore.Components.RouteData instance to the Resource parameter of AuthorizeRouteView as you suggested, the AuthorizationHandler cannot cast it. If I use the generic version of the handler with TResource set to Microsoft.AspNetCore.Components.RouteData, the handler is never invoked.

The second problem is how to display the authorization errorMessage in the NotAuthorized component. From what I can see, AuthorizeRouteView does not provide a way to surface error messages (which can be treated as the response of a failed authorization) in this scenario.

@*Routes.razor*@
<Router AppAssembly="typeof(Program).Assembly" NotFoundPage="typeof(Pages.NotFound)">
    <Found Context="routeData">
        <AuthorizeRouteView Resource="routeData" RouteData="routeData" DefaultLayout="typeof(Layout.MainLayout)">
            <Authorizing>
                <FluentStack HorizontalAlignment="HorizontalAlignment.Center" VerticalAlignment="VerticalAlignment.Center" Style="height: 100%">
                    <FluentProgressRing style="width: 62px; height: 62px;" />
                </FluentStack>
            </Authorizing>
            <NotAuthorized>
                @if (!context.User.Identity?.IsAuthenticated ?? true)
                {
                    <RedirectToLogin />
                }
                else
                {
                    <FluentMessageBar Intent="MessageIntent.Warning">Static access denied!!!</FluentMessageBar> @* There should be error message from AuthorizationHandler*@
                }
            </NotAuthorized>
        </AuthorizeRouteView>
    </Found>
</Router>

// PermissionRequirement.cs
public class PermissionRequirement : IAuthorizationRequirement
{
    public string[] Permissions { get; }
    public PermissionRequirement(params string[] permissions) => Permissions = permissions;
}

// PermissionHandler.cs standard version
public class PermissionHandler : AuthorizationHandler<PermissionRequirement>
{
    private readonly ISecurityManager _securityManager;

    public PermissionHandler(ISecurityManager securityManager)
        => _securityManager = securityManager;

    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        PermissionRequirement requirement)
    {
        var securityContext = context.Resource is Microsoft.AspNetCore.Components.RouteData route // there route is null
            ? new SecurityContext
            {
                ProjectId = route.RouteValues.TryGetValue("ProjectId", out var p) ? Convert.ToInt32(p) : null,
                DepartmentId = route.RouteValues.TryGetValue("DepartmentId ", out var c) ? Convert.ToInt32(c) : null
            }
            : new SecurityContext();


        var result = await _securityManager.HasAccess(securityContext, requirement.Permissions.ToList());

        if (result.IsSuccess)
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail(new AuthorizationFailureReason(this, result.ErrorMessage));
        }
    }
}

// version with Resource parameter of type Microsoft.AspNetCore.Components.RouteData

// PermissionHandler.cs
public class PermissionHandler : AuthorizationHandler<PermissionRequirement, Microsoft.AspNetCore.Components.RouteData>
{
    private readonly ISecurityManager _securityManager;

    public PermissionHandler(ISecurityManager securityManager)
        => _securityManager = securityManager;

    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        PermissionRequirement requirement,
        Microsoft.AspNetCore.Components.RouteData resource) // never invoked
    {
        var securityContext = resource is Microsoft.AspNetCore.Components.RouteData route
            ? new SecurityContext
            {
                ProjectId = route.RouteValues.TryGetValue("ProjectId", out var p) ? Convert.ToInt32(p) : null,
                DepartmentId = route.RouteValues.TryGetValue("DepartmentId", out var c) ? Convert.ToInt32(c) : null
            }
            : new SecurityContext();


        var result = await _securityManager.HasAccess(securityContext, requirement.Permissions.ToList());

        if (result.IsSuccess)
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail(new AuthorizationFailureReason(this, result.ErrorMessage));
        }
    }

[javiercn]

@mikermnv thanks for the additional details.

I would suggest putting a breakpoint on the requirement/handler and investigate that's going on.

It shouldn't be the case, but if the auth policy is running as part of the ASP.NET Core pipeline, you will receive the HttpContext as an instance before it gets to AuthorizeView. When you get to the AuthorizeView the resource is whatever you pass to AuthorizeView, that's why the code had two checks. I imagine if you use the typed handler with TResource the handler is filtered out. This is more of an auth question than a Blazor question. Our ability to help here is limited. If you find something not working, we recommend filing a separate issue with a minimal repro project (a console app is likely good enough for this) that shows the problem, and other folks in the repo can take a look.

As for being able to display custom messages, you'd need to do the same thing as https://github.com/dotnet/aspnetcore/blob/main/src/Components/Authorization/src/AuthorizeViewCore.cs does.

[mikermnv]

@javiercn Maybe I’m wrong, but I think this is somehow connected with Blazor. I spent some time with this code and discovered that if I navigate using enhanced navigation (throught nav menu), the AuthorizationHandler is called correctly with the typed RouteData parameter (and if I use object type instead of RouteData, it is still RouteData and it called once).

But if I perform a full page reload (F5) or naviagte from SSR page to interactive, the AuthorizationHandler is not called with the RouteData parameter. The reason is that if I pass the object type, I can see that the AuthorizationHandler is called twice: in the first case the resource parameter is HttpContext, and in the second case it is RouteData (probably it called 3 times, one more for prerendering).

The behavior seems to be that when using a typed parameter, the default handler processes the authorization request instead of our. In simple words, the user doesn’t meet the requirements in the context, so it just redirects, and the second call is not invoked from AuthorizeView.

All I want to say is that this directly depends on Blazor’s navigation behavior. I created a simple repo to reproduce this issue. All I changed were the Program and Routes files, and I added an attribute to the Counter page. I also made a video to help understand the problem faster.

I tried to fix this behavior with IAuthorizationMiddlewareResultHandler, but it gave no result.

Repo to reproduce:
mikermnv/Blazor_Resource_Authorization

Authorization_Experiment_LowQuality.mp4

And for showing errors, I understand that AuthorizeViewCore does all the work for authorization, and in this class I can find the place where the result is received. What I don’t understand is why the Blazor team decided to hide the error and operate only with a boolean result.

After all, they could have simply passed the AuthorizationResult upwards.

    private async Task<bool> IsAuthorizedAsync(ClaimsPrincipal user)
    {
        var authorizeData = GetAuthorizeData();
        if (authorizeData == null)
        {
            // No authorization applies, so no need to consult the authorization service
            return true;
        }

        EnsureNoAuthenticationSchemeSpecified(authorizeData);

        var policy = await AuthorizationPolicy.CombineAsync(
            AuthorizationPolicyProvider, authorizeData);
        var result = await AuthorizationService.AuthorizeAsync(user, Resource, policy!);
        return result.Succeeded;
    }

The only way I know is to copy the files and create my own classes. But the problem is that many things are marked as internal, which forces me to copy a lot of files — and that’s not good. Another option is simply to use reflection to access those things. Maybe there are other, more proper ways to do it.

[javiercn]

Thanks for the additional details @mikermnv.

We've split this issue to track the two separate concerns. We opened #65056 to explore exposing authorization results (such as a new Forbidden render fragment). This issue will remain focused on investigating why the authorization handlers aren't being invoked as expected.