chrissainty / rolebasedauthwithblazor

Companion code sample for my blog post - Configuring Role-based Authorization with client-side Blazor

Role-based Authorization with client-side Blazor

An example of role-based authorization using client-side Blazor, WebAPI and ASP.NET Core Identity.

Read the full blog post at https://chrissainty.com/securing-your-blazor-apps-configuring-role-based-authorization-with-client-side-blazor/.

rolebasedauthwithblazor's Issues

Ensuring role claims are available immediately

Hey Chris, I found what I think is a small bug in this code. It seems that when you first log in, the roles aren't updated in the token/claims, which means that roles don't work properly until the page refreshes or some other activity results in an authenticationStateChanged being flagged. I think this is because MarkUserAsAuthenticated is only parsing out the user claim, rather than processing the full token from the new login to get all of the user and role claims out of it.

Seems like the fix is just to change the method to do this:

    public void MarkUserAsAuthenticated(string email)
    {
        var authState = GetAuthenticationStateAsync();

        NotifyAuthenticationStateChanged( authState );
    }

since GetAuthenticationStateAsync does the full parse of the JWT for all the roles.

I think I saw somebody else raise this issue in a comment or query somewhere, and you mentioned you were going to look into it, but I didn't see a fix. Hopefully this does it for you. :)