asp.net core mvc .net8 在 403 上返回自定义视图

Question

如何显示自定义禁止视图？

我的asp.net core mvc项目有基于cookie的授权

      services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            })
            .AddCookie(options =>
            {
                options.LoginPath = "/Authorization/Login";
                options.AccessDeniedPath = "/Account/AccessDenied";
            });

这是我的政策

        services.AddAuthorizationBuilder()
            .SetDefaultPolicy(new AuthorizationPolicyBuilder(CookieAuthenticationDefaults.AuthenticationScheme)
                .RequireAuthenticatedUser()
                .Build())
            .AddPolicy(ApplicationPolicies.SuperAdministrator, op => op
                .RequireRole(ApplicationClaimValues.SuperAdministrator))
            .AddPolicy(ApplicationPolicies.Administrator, op => op
                .RequireRole(ApplicationClaimValues.SuperAdministrator, ApplicationClaimValues.Administrator))
            .AddPolicy(ApplicationPolicies.Reviewer, op => op
                .RequireRole(ApplicationClaimValues.Reviewer, ApplicationClaimValues.Administrator,
                    ApplicationClaimValues.SuperAdministrator));

当我的操作上使用 AuthorizeAttribute 时，如何在 Shared/ExtraPages/Forbidden.cshtml 上显示视图：

    [HttpPost]
    public async Task<IActionResult> Create(CreateContentCommand command)
    {
        await mediator.Send(command);
        return Redirect($"{Url.Action("Index")}?pageName={command.PageName}");
    }

给出 403 状态代码？

现在我从服务器收到一个空响应，状态为 403。

Answer 1

根据您的代码，您的AccessDeniedPath是

/Account/AccessDenied

。所以如果你想返回自定义的403 fordden页面，你应该编写Account控制器和AccessDenied视图。

然后在这个AccessDenied视图中，您可以根据您的要求设置内容。

更多详情，您可以参考下面的例子：

[AllowAnonymous]
public class AccountController : Controller
{

    public IActionResult AccessDenied()
    {
        return View();
    }
}

查看：

@{
    ViewData["Title"] = "AccessDenied";
}

<h1>AccessDenied</h1>

AccessDenied

我的授权属性：

[Authorize(Policy = "test")]
public IActionResult Privacy()
{
    return View();
}

我的程序.cs：

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
      .AddCookie(options =>
      {
          options.LoginPath = "/Authorization/Login";
          options.AccessDeniedPath = "/Account/AccessDenied";
      });


builder.Services.AddAuthorizationBuilder()
    .SetDefaultPolicy(new AuthorizationPolicyBuilder(CookieAuthenticationDefaults.AuthenticationScheme)
        .RequireAuthenticatedUser()
        .Build())
    .AddPolicy("test", op => op
        .RequireRole("admin"));

结果：