Techniques For Securing Pages - Razor Pages

[piranhacms]

Techniques For Securing Pages - Razor Pages

[tidyui]

Hi there! Which version of Piranha are you using and are you using the new startup or the old (advanced) setup?

I'm using 8.x and the assembly way of startup Code.

[tidyui]

We will add a documentation section about this.

[tidyui]

But as a preview.. If your web is built from the templates, you should add your own PageModel instead of using SinglePageModel<MyPage>. Like so

MyPage.cshtml

@page "~/myroute"
@model MyPageModel

MyPage.cshtml.cs

using Microsoft.AspNetCore.Authorization;
using Piranha;
using Piranha.AspNetCore.Models;
using Piranha.AspNetCore.Services;

[Authorize(Policy = "MyPolicyName")]
public class MyPageModel : SinglePageModel<MyPage>
{
    public MyPageModel(IApi api, IModelLoader loader) : base(api, loader) { }
}

This way you can use the AuthorizeAttribute to specify exactly who should have access to the page. It is not possible to reuse "views" with authorization attributes in the way you can with MVC as in MVC the controller action is called first and decides what view to use. In Razor Pages the "view" is called first and then tells which model to use.

Best regards

Oh @tidyui, thank you so much! You won't believe it.
I missed the '~' in the 'page' route. :-/ Sorry for wasting your time - but a section in the docs would be nice.

[tidyui]

We have new features for this is 8.1, check out the docs section for this!