How to create custom Authorization in ASP.NET Core (ASP.NET 5)

Question

I would like to have custom implementation of [Authorize] attribute in controlles.

This is what I did.

StartupClass in ConfigureServices

services.AddAuthorization(options =>
{    
    options.AddPolicy("Authorize", policy =>
    {   
         policy.AddRequirements(new MyRequirement());
    });
});

MyRequirement

public class MyRequirement : AuthorizationHandler<MyRequirement>, IAuthorizationRequirement
{
    protected override void Handle(AuthorizationContext context, MyRequirement requirement)
    {
        //some work
        //if shloud be authorized
        context.Succeed(requirement);
    }
}

TestController

[Authorize("Authorize")]
[Route("api/[controller]")]
public class TestController : Controller
{
  ...
}

What I'm I missing? MyRequirement authorizationhader is never called. Thank you.

Are you actually authenticated? Authorization won't kick into policies until you have an identity. — blowdart
– blowdart, Commented Mar 1, 2016 at 20:56
I'm not. Looks like I'm looking for Basic Authentication middleware.. — Chatumbabub
– Chatumbabub, Commented Mar 1, 2016 at 22:18
Do you mean basic as in HTTP auth, or basic as in, I want to shove this identity on every request whilst I test? — blowdart
– blowdart, Commented Mar 1, 2016 at 22:36
I would like to add token to every request(into header) and validate it by custom logic. — Chatumbabub
– Chatumbabub, Commented Mar 1, 2016 at 22:51
If a JWT token will suffice there is middleware for that. If you want your own token, then you need to write your own middleware to create an identity before any policies ever get evaluated. — blowdart
– blowdart, Commented Mar 1, 2016 at 22:52

regnauld · Accepted Answer · 2016-03-09 15:29:52Z

6

I believe you are missing this part:

services.AddSingleton<IAuthorizationHandler, MyRequirementHandler>();

Source

answered Mar 9, 2016 at 15:29

regnauld

4,3563 gold badges25 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Christophe Gigax Over a year ago

Is possible to apply a Policy without a name so that the Policy will be applied in all authorize request ?

mr_squall Over a year ago

How to get access to headers from here?

S Raghav Over a year ago

@mr_squall if you need access to headers in order to get the user/claims principal you can use context.user.Identity by typecasting it as ClaimsIdentity

Collectives™ on Stack Overflow

How to create custom Authorization in ASP.NET Core (ASP.NET 5)

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related