Introduction To Permission Authorization In ASP.NET Core 7 | Permission Authorization - Part 1

Authorization is an important topic to consider in an ASP.NET Core application. Along with authentication, it's the backbone of a reliable and secure application. In this video, I'm going to show you how to implement permission authorization. This is part 1 of a longer series on permission authorization, where we'll just lay the foundation for future videos.

Join my weekly .NET newsletter:

Read my Blog here:

Subscribe for more:

Chapters
0:00 The problem with AuthorizationAttribute
2:21 Permission authorization with HasPermissionAttribute
4:12 Defining the permissions as enums
7:31 What are going to be the next steps?

[LimitedWard]

One important security tip when implementing permission scopes like this: the default behavior for any endpoint should be to deny all requests if no permission scopes are specified. If you don't implement it this way, you could easily forget to restrict an important endpoint and inadvertently introduce vulnerabilities.

[fernandocalmet]

This is one of the series I've been waiting for the most. I enjoy and learn a lot with your content, thank you very much for sharing Milan.😃

[recepciftci]

Really excited about your future videos. Awesome work!

[richardarielcruzcespedes]

This is very useful, please keep going with this. I looking forward to seeing part 2

[MaxSupercars]

Great vid! Looking forward for next parts! The authorization is the basic part of every enterprise web application. Thanx! 🙂

[cyrildouglas]

Using enum is really a great choice for this scenario, kindly waiting for the part 2, thanks for the efforts you put into this.

[Nisa-Julie]

Every your videos is very usefull @Milan

[rahulbanerjee]

Hi Milan Literally a new fan for your great explaining techniques.
However can I request you for a video playlist of a project implementing clean architecture or DI pattern till deployment

[mahdignb]

Great stuff. I have one question and that is why you define the class as sealed in the controller and the HasPermission class either?

[grumpydeveloper]

@Milan I must be missing something. After saying that Roles and Policies have to be hardcoded you implement HasPermission as a subclass of the same attribute, Authorize, and then call the constructor of that attribute with your permission value as Policy. So in fact we are still using the Authorize attribute with the policy parameter. How is this improving things? Or are you going to implement something different than calling the base constructor in part 2 ?

[mdrahbarahmedkhan]

Hi Milan,
Thanks for the this series. It helped a lot.
Now I am wondering, how to do Permission based Authorization while using Azure Ad

[sameerkanitkar]

Hello Milan, How to update policy after the permission has been updated for any particular role. Like the user is already logged-In and if the admin updates his permission from backend how would I update user policy?

[amirkamolov]

Hello. I have a more complicated authorization problem. I need to implement resource-dependent authorization. For example, so that the user can access only those records to which he has access. Can you give me some advice ?

[abuzeralaca]

What is the starting point of this project? I would love to do this gatherly app.

[dntynme]

Could you please share a link to the related topic if it exists. Thank you in advance.

[krcarbo]

How does this work with minimal APIs please? Because we don't have an attribute if I'm not mistaken.

[alirezanet]

How the comment spam detection works in this channel !? 🤷‍♂
If you can check out your spam comments at least 😅😅🤦‍♂
I tried to suggest something 20 different ways but I failed.

[hmsiegel]

Milan, I've found that running the program after implementing these changes throws an exception. I initially thought it was something that I had done, but after loading the source code from Patreon, I'm getting the same error. I was wondering if you ran into the same issue and if you know the fix. The exception is: System.AggregateException: 'Some services are not able to be constructed (Error while validating the service descriptor 'ServiceType: Lifetime: Scoped ImplementationType: Unable to resolve service for type while attempting to activate