-
Notifications
You must be signed in to change notification settings - Fork 10.5k
Closed
Labels
✔️ Resolution: FixedThe bug or enhancement requested in this issue has been checked-in!The bug or enhancement requested in this issue has been checked-in!area-blazorIncludes: Blazor, Razor ComponentsIncludes: Blazor, Razor ComponentsenhancementThis issue represents an ask for new feature or an enhancement to an existing oneThis issue represents an ask for new feature or an enhancement to an existing onegood first issueGood for newcomers.Good for newcomers.help wantedUp for grabs. We would accept a PR to help resolve this issueUp for grabs. We would accept a PR to help resolve this issue
Milestone
Description
This prevents people from enabling authorization globally in a meaningful way for Blazor applications, since while you can apply [Authorize]
globally through _Imports.Razor, that prevents you poking holes to allow individual access to unauthenticated pages.
The fixes can be:
- Check for [AllowAnonymous] attribute here to bypass checking the auth policy.
- Update the authorization package to handle AllowAnonymous within the authorization framework by making the policy succeed.
- This second option is more involved but better in the end, since currently each individual framework (MVC, the authorization middleware and Blazor) all need to have code to handle this scenario.
roxxy4real
Metadata
Metadata
Assignees
Labels
✔️ Resolution: FixedThe bug or enhancement requested in this issue has been checked-in!The bug or enhancement requested in this issue has been checked-in!area-blazorIncludes: Blazor, Razor ComponentsIncludes: Blazor, Razor ComponentsenhancementThis issue represents an ask for new feature or an enhancement to an existing oneThis issue represents an ask for new feature or an enhancement to an existing onegood first issueGood for newcomers.Good for newcomers.help wantedUp for grabs. We would accept a PR to help resolve this issueUp for grabs. We would accept a PR to help resolve this issue