Implementing A Custom Authorization Handler In ASP.NET Core | Permission Authorization - Part 3

Authorization is an important topic to consider in an ASP.NET Core application. Along with authentication, it's the backbone of a reliable and secure application. In this video, I'm going to show you how to implement permission authorization. This is part 3 of a longer series on permission authorization, where I will show you how to implement a custom AuthorizationHandler to support authorizing endpoints using permissions.

Join my weekly .NET newsletter:

Read my Blog here:

Subscribe for more:

Chapters
0:00 Defining a custom PermissionAuthorizationHandler
4:21 How to verify if the current User has the required Permission
6:07 Defining IPermissionService and using it to complete PermissionAuthorizationHandler
8:22 Adding the IPermissionService implementation
10:51 Configuring the required services
11:51 Adding the mystery component - PermissionAuthorizationPolicyProvider
15:01 Permission Authorization in action (finally)

[MilanJovanovicTech]

If you had a dollar for every time I say _permission_ in this video, how rich would you be?

[sushilb]

Milan, you are one of the best content creator that I'm following from hundreds of others.... Loved this one.... Keep them coming....✌️

[kirillhorn]

Thanks you, Milan! Every new video I learn new and new and new!!! I really appreciate what you are doing!

[davittonoyan]

Great video, Milan I looked for video like this in past 6 months... Thank you

[talkathiriify]

Excellent topic.
Thank you very much Milan.

[adisilagy]

This is so helpful!!!
Thank you Milan

[dicusardenis]

I just wanted to thank you for everything that you are doing, your content is awesome and it helped me a lot. I think you deserve way more subscribers than you have :)
p.s. good luck, loocking forward to video course series

[fdyreog]

Every time I come to watch your video for a specific topic, I learn tons of other topics too.
Can you please make some videos about unit test and integration tests which are on a real project. Because I watched lots of videos about it, but still, I am stuck.

Thanks for that and stay awesome. 😊😊

[nove]

Way to gooo! Keep them coming. Part 4? :)

[joshuakosamu]

Thanks for the assist. Much needed help.

[acvinu]

Great video Milan, thank you very much for this

[tidianediallo]

awesome Milan, thank you off lot, may God blessyou

[megaporky]

Great post Milan. In the past when I first time implemented permissions based RBAC I spent so much time to get content that gathered here in several videos.

One thing I noticed that might be improved in your example. In AuthorizationPolicyProvider you getting policy and if it's not null you creating it. To avoid creation of the policies all the time I'd suggest to take options from constructor to local variable and then slightly modify GetPolicyAsync to:

if (policy == null)
{
if (Enum.TryParse<PermissionId>(policyName, out var permissionId))
{
policy = new AuthorizationPolicyBuilder()
.AddRequirements(new
.Build();

// Add policy to the AuthorizationOptions, so we don't have to re-create it each time
options.Value.AddPolicy(policyName, policy);
}

[alirezanet]

The thing I was talking about before in other videos in this series was a third way to solve the problem you mentioned here 4:30 . (for authorization without calling the database and dealing with caches or storing all claims in jwt token) which is using enum flags. this is a much faster and more flexible way to deal with this problem. and we can use a single value in the database or jwt tokens, instead of list of permissions.

[bilalmehrban]

Thank you, explained it beautifully. Have you combined this with Identity?

[Dustyy]

In the next video u will show how to put the permissions into the claimsidentity. The thing with JWTs is that once they're created u cannot update them.
How would u handle permission updates in this case?

[algernonloos]

Hi, Milan! Thanks for the video series, they help me to progress on my pet project
I've got a question: Why are AuthorizationHandlers defined in the Infrastructure project, and not in the Application project for instance? What's the logic behind that?

[andyhb]

Hi Milan, just followed your video series through and your explanation of the various classes required to implement a full featured custom authorization are superb and have saved me endless hours I'm sure! I wanted my permission model to be split into two elements e.g. Users with Author, Contributer and Viewer levels. To achieve this I have just concatenated the Permission and Level enums to create my policy name within the HasPermissionAttribute and then I deconstruct them in the policy provider to allow the correct creation of my permission requirement, do you think this sensible?

[edgarvalcarcel]

Flexible implementation of a complicated code, But Interesting

[justhobbes]

Good job! Will you look into resource-based authorisation?