Controlling the user interface using authorization

After a user is authenticated, authorization rules are used to control what the user can see and do. The Authorize attribute and the AuthorizeView component are used to control the user interface.

The Authorize attribute

The Authorize attribute is used to require that the user is authorized to view the page that is decorated with the attribute. It should only be used on routable components. The following component includes the Authorize attribute:

Secure.razor

@page "/secure"
@using Microsoft.AspNetCore.Authorization
@attribute [Authorize]
<h2>Secure Page</h2>
Congratulations, you have been authenticated!

When an unauthenticated user tries to navigate to a page with the Authorize attribute, they are automatically redirected to the /authentication/login page.

TIP

You can require authentication for every page by adding the Authorize attribute to the _Imports.razor file. However...