Blazor中AuthorizeView认证状态更新不实时，仅刷新生效的问题

1. 修正CustomAuthStateProvider的GetAuthenticationStateAsync方法 #

移除方法内的NotifyAuthenticationStateChanged调用，该方法仅需返回当前认证状态，状态变更由ChangeUser方法主动触发：

public override async Task<AuthenticationState> GetAuthenticationStateAsync()
{        
    var result = await protectedSessionStore.GetAsync<string>("authToken");
    var token = result.Success ? result.Value : string.Empty;
    
    var identity = string.IsNullOrWhiteSpace(token)
        ? new ClaimsIdentity()
        : new ClaimsIdentity(ParseClaimsFromJwt(token), "jwt");
    
    return new AuthenticationState(new ClaimsPrincipal(identity));
}

2. 完善ChangeUser方法 #

确保状态通知传递的Task包含正确的认证状态实例：

public async Task ChangeUser(string token)
{
    ClaimsPrincipal claimsPrincipal;

    if (string.IsNullOrWhiteSpace(token))
    {
        await protectedSessionStore.DeleteAsync("authToken");
        claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity());
    }
    else
    {
        await protectedSessionStore.SetAsync("authToken", token);
        claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity(ParseClaimsFromJwt(token), "jwt"));
    }
    
    Console.WriteLine($"UpdateAuthenticationState - IsAuthenticated: {claimsPrincipal.Identity?.IsAuthenticated}");
    foreach (var claim in claimsPrincipal.Claims)
    {
        Console.WriteLine($"Claim: {claim.Type} = {claim.Value}");
    }

    NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(claimsPrincipal)));
}

3. 简化Login页面的HandleLoginInternal方法 #

移除重复的令牌存储操作，认证状态更新后直接导航：

private async Task HandleLoginInternal()
{
    var response = await Http.PostAsJsonAsync("User/login", Model);
    if (response.IsSuccessStatusCode)
    {
          var token = await response.Content.ReadAsStringAsync();
          await AuthStateProvider.ChangeUser(token);
          Navigation.NavigateTo("/");
    }
}

4. 优化Login页面的AuthorizeView结构 #

将登录表单放入NotAuthorized模板，确保仅未登录用户可见：

<AuthorizeView>
    <Authorized>
        @{ Navigation.NavigateTo("/"); }
    </Authorized>
    <NotAuthorized>
        <EditForm Model="@Model" FormName="Login" OnValidSubmit="HandleLogin">    
            <InputText @bind-Value="Model.Username" placeholder="Username" />
            <InputText @bind-Value="Model.Password" type="password" />
            <button type="submit">Login</button>
        </EditForm>
    </NotAuthorized>
</AuthorizeView>

@code {
    [SupplyParameterFromForm]
    public LoginModel Model { get; set; } = new();
    
    private async Task HandleLogin(EditContext obj) => await HandleLoginInternal();

    private async Task HandleLoginInternal()
    {
        var response = await Http.PostAsJsonAsync("User/login", Model);
        if (response.IsSuccessStatusCode)
        {
              var token = await response.Content.ReadAsStringAsync();
              await AuthStateProvider.ChangeUser(token);
              Navigation.NavigateTo("/");
        }
    }

    public class LoginModel
    {
        public string Username { get; set; }
        public string Password { get; set; }
    }
}

关键说明 #

• NotifyAuthenticationStateChanged是触发AuthorizeView等组件重新渲染的核心，必须在认证状态确实变更时调用，且传递的Task需包含最新的AuthenticationState。
• 禁止在GetAuthenticationStateAsync中调用NotifyAuthenticationStateChanged，该方法是框架获取当前状态的入口，主动调用会导致状态逻辑混乱。
• 登录后无需手动调用StateHasChanged，状态通知会自动触发组件更新。

内容的提问来源于stack exchange，提问作者hyperbeecore