title: Authorization in ASP .NET Core Razor pages
body: <p>I am unable to implement policy-based authorization in ASP .NET Core for an action on a razor page.</p>
  
  <p>I read through <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-2.2" rel="noreferrer">this comprehensive document on authorization</a> and used its examples as guidence.</p>
  
  <p>Razor page action code:</p>
  
  <pre><code>[Authorize(Policy = "test")]
  public async Task&lt;IActionResult&gt; OnGetCreateAsync(string id)
  </code></pre>
  
  <p>Code in service configuration:</p>
  
  <pre><code>_ = services.AddAuthorization(options =&gt; {
      options.AddPolicy("test", policy =&gt;
          policy.RequireAssertion(context =&gt;
              false));
  });
  </code></pre>
  
  <p>I expect that if I call the action or endpoint service, e.g.</p>
  
  <pre><code>GET /Account?handler=Create
  </code></pre>
  
  <p>then the request will be denied with a 403 status response because the "test" policy states that everyone is unauthorized. However, in actual practice, the action is successfully called. </p>