ASP.NET Core MVC中Cookie Authentication与Claims Identity的角色菜单导航最佳实现方案

Hey there! Since you've already got Cookie Authentication and Claims Identity set up in your ASP.NET Core MVC app, let's walk through how to implement role-based menu rendering and share the best practices to make this setup solid and maintainable.

Step 1: Ensure Roles Are Properly Added to Claims #

First off, make sure when users log in, their assigned roles are added as ClaimTypes.Role claims. If you're using ASP.NET Core Identity, this is usually handled automatically, but if you have a custom login flow, you'll need to add them explicitly:

// Example in your custom login logic
var claims = new List<Claim>
{
    new Claim(ClaimTypes.Name, user.UserName),
    // Map user roles to claims
    ...user.Roles.Select(r => new Claim(ClaimTypes.Role, r.RoleName))
};

var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity));

Step 2: Define a Menu Item Model #

Create a simple model to represent your menu items, including role restrictions and nested child items:

public class MenuItem
{
    public string Text { get; set; }
    public string Controller { get; set; }
    public string Action { get; set; }
    public string Area { get; set; } = string.Empty;
    public List<string> AllowedRoles { get; set; } = new();
    public List<MenuItem> ChildItems { get; set; } = new();
}

Step 3: Build a Menu Service to Filter Items by Role #

Create a dedicated service to handle menu filtering based on the current user's roles. This keeps your view logic clean and reusable:

public interface IMenuService
{
    List<MenuItem> GetUserMenu();
}

public class MenuService : IMenuService
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public MenuService(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    public List<MenuItem> GetUserMenu()
    {
        // In production, load this from a database instead of hardcoding
        var allMenuItems = new List<MenuItem>
        {
            new() { Text = "Home", Controller = "Home", Action = "Index", AllowedRoles = { "Admin", "User", "Guest" } },
            new() { 
                Text = "Admin Panel", 
                Controller = "Admin", 
                Action = "Dashboard", 
                AllowedRoles = { "Admin" },
                ChildItems = new()
                {
                    new() { Text = "Manage Users", Controller = "Admin", Action = "Users", AllowedRoles = { "Admin" } }
                }
            },
            new() { Text = "Profile", Controller = "Account", Action = "Profile", AllowedRoles = { "Admin", "User" } }
        };

        var currentUser = _httpContextAccessor.HttpContext.User;
        return allMenuItems.Where(item => 
            // Show item if user has any allowed role
            item.AllowedRoles.Any(role => currentUser.IsInRole(role)) || 
            // Show guest items to unauthenticated users
            item.AllowedRoles.Contains("Guest") && !currentUser.Identity.IsAuthenticated
        ).ToList();
    }
}

Don't forget to register this service in Program.cs:

builder.Services.AddScoped<IMenuService>();
builder.Services.AddHttpContextAccessor();

Step 4: Render the Menu in Your View #

You can render the menu directly in your layout, or use a ViewComponent for better modularity. Here's a quick layout example:

<nav class="main-nav">
    <ul>
        @foreach (var item in @Model.MenuItems)
        {
            <li>
                <a asp-controller="@item.Controller" asp-action="@item.Action" asp-area="@item.Area">@item.Text</a>
                @if (item.ChildItems.Any())
                {
                    <ul class="sub-nav">
                        @foreach (var child in item.ChildItems)
                        {
                            <li><a asp-controller="@child.Controller" asp-action="@child.Action">@child.Text</a></li>
                        }
                    </ul>
                }
            </li>
        }
    </ul>
</nav>

For a ViewComponent, create MenuViewComponent.cs:

public class MenuViewComponent : ViewComponent
{
    private readonly IMenuService _menuService;

    public MenuViewComponent(IMenuService menuService)
    {
        _menuService = menuService;
    }

    public IViewComponentResult Invoke()
    {
        var menuItems = _menuService.GetUserMenu();
        return View(menuItems);
    }
}

Then call it in your layout with:

@await Component.InvokeAsync("Menu")

Best Practices for Role-Based Menu Navigation #

Let's cover the key practices to make this setup robust and maintainable:

• Use Policy-Based Authorization Instead of Hardcoded Roles
  Instead of checking specific roles directly, define authorization policies to abstract permissions. This makes it easier to adjust access rules later:

  builder.Services.AddAuthorization(options =>
  {
      options.AddPolicy("CanAccessAdminPanel", policy => 
          policy.RequireRole("Admin", "SuperAdmin"));
      options.AddPolicy("CanManageUsers", policy => 
          policy.RequireRole("Admin"));
  });
  

  Update your MenuItem to use policy names instead of role lists, then check currentUser.HasClaim(c => c.Type == ClaimTypes.Permission && c.Value == policyName) in your menu service.

• Load Menu Data from a Database
  Hardcoding menu items works for small apps, but for production, store menu items (with associated roles/policies) in a database. This lets you update menus without redeploying, and supports dynamic role assignments.

• Cache Menu Data
  Menu data doesn't change often, so cache filtered menus per user or role group to reduce database hits. Use IMemoryCache or IDistributedCache:

  public List<MenuItem> GetUserMenu()
  {
      var cacheKey = $"UserMenu_{_httpContextAccessor.HttpContext.User.Identity.Name}";
      if (_cache.TryGetValue(cacheKey, out List<MenuItem> cachedMenu))
      {
          return cachedMenu;
      }
      var menu = FetchAndFilterMenuFromDb();
      _cache.Set(cacheKey, menu, new MemoryCacheEntryOptions { AbsoluteExpirationRelativeToNow = TimeSpan.FromHours(1) });
      return menu;
  }
  

• Keep View Logic Minimal
  Avoid writing role checks directly in views (like @if(User.IsInRole("Admin"))). Let the menu service or ViewComponent handle filtering so views only focus on rendering.

• Handle Anonymous Users Gracefully
  Ensure your menu includes items for unauthenticated users (Login, Register) and hides restricted items by default.

• Align Menu Permissions with Page/API Security
  Never rely on menu hiding as the only security measure. Always apply authorization attributes to controllers/actions:

  [Authorize(Policy = "CanAccessAdminPanel")]
  public class AdminController : Controller
  {
      // ...
  }
  

  This prevents users from accessing restricted pages even if they manually type the URL.

内容的提问来源于stack exchange，提问作者Poonam Londhe