如何检查API请求中的值声明（ASP.NET Core 2.2）

Question

I'm using claims-based-identity in ASP.NET Core 2.2

From what I've read, it's possible to make custom claims/policy authorization using the following format (found in this answer)

[Authorize(Policy = "DataDrivenExample")]
public IActionResult GetFooBar()
{
    // Omitted for brevity...
}

However, in my application, I need to check whether the user has access to THIS specific object. For example, something like this:

[Authorize(Policy = "EditFooBar:" + id)]
public IActionResult EditFooBar(string id)
{
    // Omitted for brevity...
}

The handler then something like this...?

public class EditFooBarHandler : AuthorizationHandler<DataDrivenRequirement>
{

protected override void Handle(AuthorizationContext context, 
                               string id)
{
    var hasClaim = context.HttpContext.User.Claims.Any(c => c.Type == "EditFooBar" && c.Value == id);
    ...etc...
}

It's not really feasible to make a separate policy for every possible value of id .

Basically, how can I pass data into a policy requirement checker that is different for every request to that API endpoint?

Answer 1

I believe what you are looking for in this case is Resource-based Authorization.

https://docs.microsoft.com/en-us/aspnet/core/security/authorization/resourcebased?view=aspnetcore-2.2