CODEWITHSUNDEEP
asp.net-core.net-coreasp.net-core-webapiasp.net-authorization
Notbad
Notbad

Reputation: 6296

Resource Based authorization for a list of reosurces?

How do you implement authorization for a list of resources?

All docs I see are based on IAuthorizationService and the AuthorizeAsync methods. But this, only applies to one resource.

Should I be retrieving all resources and then imperatively check if the user has access or not using the AuthorizeAsync method of the IAuthorizationService? This seems very ackward, slow and inneficient.

How would you do this?

Upvotes: 6

Views: 741

Answers (1)

Nemanja Todorovic
Nemanja Todorovic

Reputation: 2800

I have implemented this in few of my projects and aside from fetching all resources from the database and then executing AuthorizeAsync on each of them there is not much that you can do (so far as I know).

In some cases you can have mapping table in the database that stores resourceId/userId and check according to that. It is easier to fetch items that way without executing AuthorizeAsync on each, but it is not applicable in each scenario...

There are a few questions on this subject (such as https://github.com/dotnet/AspNetCore.Docs/issues/10244) but no solution.

Upvotes: 1

Related Questions