Fix AuthorizeIndexPageHandlerFilter security flaw: pipeline not short-circuited on auth failure

[Copilot]

The AuthorizeIndexPageHandlerFilter example allowed unauthorized users to execute protected page handlers because authorization ran in OnPageHandlerSelectionAsync (which has no way to set a result), while OnPageHandlerExecutionAsync unconditionally called next().

Changes

• Moved authorization logic from OnPageHandlerSelectionAsync into OnPageHandlerExecutionAsync
• Set context.Result to ChallengeResult/ForbidResult on failure without calling next(), properly short-circuiting the pipeline
• OnPageHandlerSelectionAsync is now a no-op
• Updated prose to reference OnPageHandlerExecutionAsync

public async Task OnPageHandlerExecutionAsync(PageHandlerExecutingContext context,
    PageHandlerExecutionDelegate next)
{
    // ... attribute/policy resolution ...

    if (authorizeResult.Challenged)
    {
        context.Result = policy.AuthenticationSchemes.Count > 0
            ? new ChallengeResult(policy.AuthenticationSchemes.ToArray())
            : new ChallengeResult();
        return; // does NOT call next() — handler is blocked
    }
    else if (authorizeResult.Forbidden)
    {
        context.Result = policy.AuthenticationSchemes.Count > 0
            ? new ForbidResult(policy.AuthenticationSchemes.ToArray())
            : new ForbidResult();
        return; // does NOT call next() — handler is blocked
    }

    await next(); // only reached on successful authorization
}

public Task OnPageHandlerSelectionAsync(PageHandlerSelectedContext context)
    => Task.CompletedTask;

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/razor-pages/security/authorization/simple.md	aspnetcore/razor-pages/security/authorization/simple