[Blazor] Multiple layout per page or Custom access check solution #64928

There are two separate concerns here: composing layouts and enforcing authorization. Blazor supports the first directly, but a layout should not be your only security boundary.

If the check is a normal policy

Prefer ASP.NET Core authorization and leave the existing layout alone:

@page "/secured-page"
@attribute [Authorize(Policy = "CanViewSecuredPage")]
@layout MainLayout

With AuthorizeRouteView in the router, the route is rendered only when the policy succeeds, and the router can display the NotAuthorized content. This keeps authorization independent from visual structure.

If the decision needs a runtime resource/context

An attribute runs before a page-specific resource has been loaded, so use resource-based authorization with IAuthorizationService:

@using Microsoft.AspNetCore.Authorization
@using Microsoft.AspNetCore.Components.Authorization
@inject IAuthorizationService Authorization

@if (_allowed is null)
{
    <p>Checking access...</p>
}
else if (_allowed.Value)
{
    <PageContent />
}
else
{
    <AccessDenied />
}

@code {
    [CascadingParameter]
    private Task<AuthenticationState> AuthenticationState { get; set; } = default!;

    [Parameter]
    public MySecurityContext Context { get; set; } = default!;

    private bool? _allowed;

    protected override async Task OnParametersSetAsync()
    {
        var user = (await AuthenticationState).User;
        var result = await Authorization.AuthorizeAsync(
            user, Context, "CanAccessContext");

        _allowed = result.Succeeded;
    }
}

The policy handler can internally call your SecurityManager.HasAccess, but expressing the decision as a requirement/handler makes it reusable and testable. Microsoft documents this imperative pattern here:
https://learn.microsoft.com/en-us/aspnet/core/security/authorization/resource-based

A small reusable PermissionView component around that logic is not a workaround to avoid; component composition is the idiomatic solution when multiple pages need the same resource check. It can expose Authorized, NotAuthorized, and Authorizing render fragments, similar to AuthorizeView.

If you only need to preserve both visual layouts

Layouts can be nested. Your access layout can itself use the existing layout:

@* AccessLayout.razor *@
@inherits LayoutComponentBase
@layout MainLayout

<PermissionView Context="CurrentContext">
    <Authorized>
        @Body
    </Authorized>
    <NotAuthorized>
        <AccessDenied />
    </NotAuthorized>
</PermissionView>

Then the page selects AccessLayout; Blazor renders that inside MainLayout. Nested layouts are supported explicitly:
https://learn.microsoft.com/en-us/aspnet/core/blazor/components/layouts#nested-layouts

The nested-layout option is useful for shared presentation, but there are two important security rules:

1. Hiding @Body only controls rendered UI. The server endpoint/API that returns or mutates protected data must perform the same authorization check.
2. Do not load sensitive data before the authorization decision has succeeded.

So the usual choice is: policy + [Authorize] for static page requirements, IAuthorizationService.AuthorizeAsync(user, resource, policy) for contextual requirements, and nested layouts only when you genuinely need another visual layer.

If this gives you the structure you need, you can mark it as the accepted answer so the authorization/layout distinction is easy for future readers to find.