Blazor Server: don't bind event listener for non-rendered element

I’m interested in keeping authorization simple by using the AuthorizeView component. This request is an elaboration of the documentation issue: dotnet/AspNetCore.Docs/issues/20462.

In short, say I have Blazor pages, each of which requires authentication and role-based authorization:

@page "/page1"
@attribute [Authorize]

<AuthorizeView Role="page1">
    <!-- SECURE CONTENT -->
    <button @onclick="SecureAction">Secure Action</button>
</AuthorizeView>

@code {
    private void SecureAction()
    {
        // Unauthorized users should not be able to execute this code path
    }
}

It would be nice if it was impossible for clients to manually trigger the SecureAction method. In this case, because the only element to which it binds is not rendered, no SignalR event listener should be bound.

I would prefer not to inject the AuthenticationStateProvider in every page and guard every protected task/method with it.

re: @guardrex

[pranavkm]

@shanemikel by default event handlers for non-rendered elements are unable to be invoked. The scenario @javiercn was talking of was that if your authorization status changes after an element is rendered, there is a small window (in the order of milliseconds) before a new render that event handlers could be triggered. (

[Initially authorized] --> [Unauthorized / StateHasChanged] … You can continue to trigger the event now … --> [Render](Now it’s no longer possible to trigger)

If you were concerned about the small window, you could consider using the pattern @javiercn suggested. Most users would not need to worry about this.

@guardrex I don’t think this needs to be documented.

[javiercn]

Closing this issue since the original question was answered.