Edit

Policy-based authorization in ASP.NET Core MVC

This article provides additional MVC policy-based authorization scenarios following Policy-based authorization in ASP.NET Core, which should be read before this article when learning about policy-based authorization.

Apply policies to MVC controllers

Apply policies to controllers using the [Authorize] attribute with the policy name:

[Authorize(Policy = "AtLeast21")]
public class AtLeast21Controller : Controller
{
    public IActionResult Index() => View();
}

If multiple policies are applied at the controller and action levels, all policies must pass before access is granted:

[Authorize(Policy = "AtLeast21")]
public class AtLeast21Controller2 : Controller
{
    [Authorize(Policy = "IdentificationValidated")]
    public IActionResult Index() => View();
}

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[Authorize(Policy = "AtLeast21")]
public class AlcoholPurchaseController : Controller
{
    public IActionResult Index() => View();
}

Access MVC request context in handlers

The AuthorizationHandler<TRequirement>.HandleRequirementAsync method has two parameters: an AuthorizationHandlerContext and the TRequirement being handled. Frameworks such as MVC or SignalR are free to add any object to the AuthorizationHandlerContext.Resource property to pass extra information.

When using endpoint routing, authorization is typically handled by the Authorization Middleware, and the Resource property is an instance of HttpContext. The context is used to access the current endpoint, which can be used to probe the underlying resource to which you're routing:

if (context.Resource is HttpContext httpContext)
{
    var endpoint = httpContext.GetEndpoint();
    var actionDescriptor = 
        endpoint?.Metadata.GetMetadata<ControllerActionDescriptor>();
    ...
}

With traditional routing, or when authorization happens as part of MVC's authorization filter, the value of Resource is an AuthorizationFilterContext instance. This property provides access to HttpContext, RouteData, and everything else provided by MVC and Razor Pages.

The use of the Resource property is framework-specific. Using information in the property limits your authorization policies to particular frameworks. Cast the property using the is keyword, and then confirm the cast has succeeded to ensure your code doesn't crash with an InvalidCastException when run on other frameworks. When the cast succeeds, examine MVC-specific data, such as routing data:

using Microsoft.AspNetCore.Mvc.Filters;

...

if (context.Resource is AuthorizationFilterContext mvcContext)
{
    var routeValues = mvcContext.RouteData.Values;
    ...
}

Note

Endpoint routing passes RouteEndpoint to authorization handlers, unlike traditional routing in MVC apps, which use an authorization handler context resource of type AuthorizationFilterContext. If the app uses MVC authorization filters along with endpoint routing authorization, it may be necessary to handle both types of resources.

  • Last updated on