How do I use authorization filters in ASP.NET Core?

How do I use authorization filters in ASP.NET Core?

In ASP.NET Core, you can use authorization filters to enforce security policies on your controllers or actions. You can create a custom authorization filter by implementing the IAuthorizationFilter interface.

Can you give me an example of a custom authorization filter?

Sure! Here's a simple example:

public class CustomAuthorizationFilter : IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationFilterContext context)
    {
        // Your authorization logic here
        if (!context.HttpContext.User.Identity.IsAuthenticated)
        {
            context.Result = new UnauthorizedResult();
        }
    }
}

How do I apply this filter to a controller?

You can apply the filter at the controller level or action level using the [ServiceFilter] or [TypeFilter] attributes. For example:

[ServiceFilter(typeof(CustomAuthorizationFilter))]
public class MyController : Controller
{
    // Actions here
}

What if I want to use built-in authorization policies?

You can use the [Authorize] attribute with policies defined in your Startup.cs. For example:

services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
});

[Authorize(Policy = "AdminOnly")]
public class AdminController : Controller
{
    // Admin actions here
}