asp.net core razor use of role in view

Question

I want to be able to give users access to view sections of the View and I can do that with @ if (Model.UserDataRole.RoleName == "Issuer" ) { //some divs here } and if @ if (Model.UserDataRole.RoleName == "Admin" ) { //other divs here } My questions, is it safe to do so or I should try to do it in the cshtml.cs instead?

Sachin Singh · Answer

use partial view in razor and bind your partialview with viewmodel (Mydata (in below example)) public class PartialDemoModel : PageModel { public void OnGet() { if(UserDataRole.RoleName == "Issuer" ) { //retrieve user related data mydata.user u=new user(); u.Name= "user" ; ..... } else { retrieve Admin related data Mydata.Admin a=new Admin(); a.name= "Admin" ; } } } ....razor...... @page @model MyData @{ } "_Partial1" model= "Model.MyData" /> ....partial view...... @model MyData if (Model.UserDataRole.RoleName == "Issuer" ) { model.User.Name //some divs here } @if (Model.UserDataRole.RoleName == "Admin" ) { model.Admin.Name //other divs here } ......model..... public class MyData { public User user{get;set;} // user class public Admin admin{get;set;} // admin class public userdataRole role {get;set;} // role class }

Sachin Singh · Answer

obviously unsafe ,you are exposing roles to outside world, anybody can inspect and know. sure do it in cshtml.cs.

Sachin Singh · Answer

yes looks safe now but on inspect they still can see both data.

Marius Vasile · Answer

Yeah, partialView is a very good one as well

Marius Vasile · Answer

So I used var userId = User.FindFirstValue(ClaimTypes.NameIdentifier); var userRole = await _context.UserRoles.Where(x => x.UserId == userId).SingleOrDefaultAsync(); var myS = "Receiver" ; UR = userRole.Equals(myS); and in View @ if (Model.UR == true ) { class = "col-12" > class = "col-6" > class = "btn btn-link border border-success" >ACCEPT class = "col-6" > class = "btn btn-link border border-danger" >REJECT } Safe now?

Marius Vasile · Answer

Thank you Sachin, so I can use some "fake "Models then to achieve the same result, or use a Count. Because I don't know how to achieve that from cshtml.cs but only to give access or not to the whole page. portions of the page....I don't know how