如何在 AuthorizationHandler 中获取 Controller 和 Action？

Question

I am just wondering is it possible to get Controller and Action in an AuthorizationHandler ?. It is needed in order to be able to validate user's role based on the requested action.

I'm able to get reference to HttpContext . But the HttpContext.Request.RouteValues seems inaccessible.

Does anyone has any idea? my code:

public class RoleHandler :
    AuthorizationHandler<RoleRequirement>
{
    private readonly IUnitOfWork _context;
    private readonly IHttpContextAccessor _httpContext;

    public RoleHandler(IHttpContextAccessor httpContext, IUnitOfWork context)
    {
        _context = context;
        _httpContext = httpContext;
    }
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext authorizationcontext,
        RoleRequirement requirement)
    {
        var roleClaim = authorizationcontext.User.Claims
            .Where(c =>
                 c.Type == ClaimTypes.Role);

        var routeData = authorizationcontext.Resource ;


        if (ThisRoleIsAllowed(roleClaim, requirement.ActionName).Result)
            authorizationcontext.Succeed(requirement);
        return Task.CompletedTask;
    }

Answer 1

Let me summarize here what we had discussed so far. (My intention is to capture the valuable information from the comments).

The OP wants to implement a resource ( endpoint ) based Authorization . (The ASP.NET Core standard is the role based.) In order to do so, the following information is needed:

• The resolved controller and action name (resolved means based on the routing table, which controller's which action should handle the particular request)

Based on these and the role claim the Authorization logic easily can decide whether or not the requester is allowed to access the resource.

---

To able to retrieve the controller's name and action's name I suggested the following:

• Call the GetEndPoint extension method on the HttpContext
• Call the GetMetadata<ControllerActionDescriptor> on the Endpoint
• Access the ControllerName and ActionName on the ControllerActionDescriptor ( 1 )

So, to sum up:

public class RoleHandler: AuthorizationHandler<RoleRequirement>
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    protected override Task HandleRequirementAsync
      (AuthorizationHandlerContext authorizationcontext, RoleRequirement requirement)
    {
         var endpoint = _httpContextAccessor.HttpContext.GetEndpoint();
         var descriptor = endpoint.Metadata.GetMetadata<ControllerActionDescriptor>();
         var controllerName = descriptor.ControllerName;

         //...
    }
}