How to check claim for value in API request (ASP.NET Core 2.2)

Question

I'm using claims-based-identity in ASP.NET Core 2.2

From what I've read, it's possible to make custom claims/policy authorization using the following format (found in this answer)

[Authorize(Policy = "DataDrivenExample")]
public IActionResult GetFooBar()
{
    // Omitted for brevity...
}

However, in my application, I need to check whether the user has access to THIS specific object. For example, something like this:

[Authorize(Policy = "EditFooBar:" + id)]
public IActionResult EditFooBar(string id)
{
    // Omitted for brevity...
}

The handler then something like this...?

public class EditFooBarHandler : AuthorizationHandler<DataDrivenRequirement>
{

protected override void Handle(AuthorizationContext context, 
                               string id)
{
    var hasClaim = context.HttpContext.User.Claims.Any(c => c.Type == "EditFooBar" && c.Value == id);
    ...etc...
}

It's not really feasible to make a separate policy for every possible value of id.

Basically, how can I pass data into a policy requirement checker that is different for every request to that API endpoint?

First, claims are no supposed to be permissions. Claims are usually stuff that rarely changes (name, last name, email, birthday etc.) and your policies would be then more based on cases rather than permissions (i.e. "PlaceOrder", "ManageUsers" etc. rather than "delete user", "read user", "edit user"). To (ab)use claims for ACL see this answer — Tseng
– Tseng, Commented Mar 5, 2019 at 16:54

alans · Accepted Answer · 2019-03-05 17:31:16Z

3

I believe what you are looking for in this case is Resource-based Authorization.

https://learn.microsoft.com/en-us/aspnet/core/security/authorization/resourcebased?view=aspnetcore-2.2

answered Mar 5, 2019 at 17:31

alans

1,0509 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to check claim for value in API request (ASP.NET Core 2.2)

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related