Asp.Net Core RazorPages AuthorizeFolder with an exceptional page - asp.net-core

Question

In RazorPagesOptions in asp.net core 3,
I authorized a folder FolderA with policy PolicyA like below.
options.Conventions.AuthorizeFolder("/FolderA", "PolicyA");
But I want to apply an exceptional policy PolicyB to a page PageB under FolderA,
so that users who entitled PolicyB but not entitled PolicyA can access PageB
while cannot access the other pages under FolderA.
I tried to add a page authorization like below
options.Conventions.AuthorizePage("/FolderA/PageB", "PolicyB");
but, it does not allow users who entitled PolicyB without PolicyA to access the the PageB.
Is there a way to give a policy exception to a specific page under a authorized folder?

Answer 1

As a workaround, you can dynamically check the path in policy to allow the specific page . For example :
services.AddRazorPages().AddRazorPagesOptions(options =>
{
options.Conventions.AuthorizeFolder("/FolderA", "PolicyA");
});
services.AddAuthorization(options =>
{
options.AddPolicy("PolicyA", policy =>
{
policy.RequireAssertion(context =>
{
var resource = context.Resource.ToString();
if (resource.Equals("/FolderA/PageB"))
{
return true;
}
return false;
});
});
});
So that any request to FolderA will fire the policy , you can then add your custom logic in policy , for example , check user claim from context.User.Claims .