Blazor Server已认证未验证用户的条件重定向实现咨询

1. 完善App.razor的NotAuthorized逻辑 #

在NotAuthorized模板的else分支中，判断已认证用户是否缺少VerifiedUser角色，同时排除验证页路径避免循环重定向，之后重定向到验证页。修改后的代码如下：

<Fluxor.Blazor.Web.StoreInitializer />

<CascadingAuthenticationState>
    <Router AppAssembly="@typeof(App).Assembly">
        <Found Context="routeData">
            <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
                <NotAuthorized>
                    @if (context.User.Identity?.IsAuthenticated != true)
                    {
                        <HxRedirectTo Uri="@("/Identity/Account/Login")" />
                    }
                    else
                    {
                        // 检查用户无VerifiedUser角色且当前页面不是验证页
                        var isVerificationPage = routeData.RouteValues["page"]?.ToString() == "Verification";
                        if (!context.User.IsInRole("VerifiedUser") && !isVerificationPage)
                        {
                            <HxRedirectTo Uri="@("/Verification")" />
                        }
                        else
                        {
                            <p>您没有权限访问此页面，请先完成资料验证。</p>
                        }
                    }
                </NotAuthorized>
            </AuthorizeRouteView>
        </Found>
        <NotFound>
            <PageTitle>Not found</PageTitle>
            <LayoutView Layout="@typeof(MainLayout)">
                <p role="alert">Sorry, there's nothing at this address.</p>
            </LayoutView>
        </NotFound>
    </Router>
</CascadingAuthenticationState>

说明：根据你的路由配置调整isVerificationPage的判断逻辑，比如用页面命名空间判断routeData.PageType.FullName.Contains("YourProject.Pages.Verification")。

2. 全局导航监听（可选） #

为了覆盖所有导航场景（包括内部路由跳转），可以在MainLayout中监听NavigationManager的位置变化事件，确保每次导航都做角色校验：

@inject NavigationManager NavManager
@inject AuthenticationStateProvider AuthStateProvider
@implements IDisposable

@code {
    protected override void OnInitialized()
    {
        NavManager.LocationChanged += OnLocationChanged;
        base.OnInitialized();
    }

    private async void OnLocationChanged(object sender, LocationChangedEventArgs e)
    {
        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
        var user = authState.User;

        // 排除无需拦截的路径
        var excludedPaths = new[] { "/Identity/Account/Login", "/Verification", "/Identity/Account/Register" };
        if (user.Identity?.IsAuthenticated == true && 
            !user.IsInRole("VerifiedUser") && 
            !excludedPaths.Any(path => e.Location.EndsWith(path)))
        {
            NavManager.NavigateTo("/Verification", forceLoad: false);
        }
    }

    public void Dispose()
    {
        NavManager.LocationChanged -= OnLocationChanged;
    }
}

3. 验证完成后更新角色并刷新状态 #

当用户完成资料验证后，为其添加VerifiedUser角色，并刷新登录状态，确保后续授权检查能识别新角色：

@inject UserManager<IdentityUser> UserManager
@inject SignInManager<IdentityUser> SignInManager
@inject NavigationManager NavManager
@inject IHttpContextAccessor HttpContextAccessor

private async Task CompleteVerification()
{
    // 保存用户资料逻辑...

    var user = await UserManager.GetUserAsync(HttpContextAccessor.HttpContext.User);
    await UserManager.AddToRoleAsync(user, "VerifiedUser");
    
    // 刷新登录状态，更新认证cookie
    await SignInManager.RefreshSignInAsync(user);
    
    // 重定向到CRM首页
    NavManager.NavigateTo("/CRM/Home");
}

4. 验证页的授权配置 #

确保验证页仅添加[Authorize]特性，允许所有已认证用户访问：

[Authorize]
public class Verification : ComponentBase
{
    // 验证页逻辑代码...
}

内容的提问来源于stack exchange，提问作者Danny Mizulin