CODEWITHSUNDEEP
asp.netasp.net-authorization
Apahdos
Apahdos

Reputation: 83

What is the difference between authorization claims and request parameters in ASP.NET?

What is the difference between using an authorization claim or role, and using the parameter of a, let's say, GET request?

For example, I want a user to access only his own data.

I can have a controller with two GET method - first using the parameter:

[HttpGet]
[Authorize]
public async Task<ActionResult<IEnumerable<DataDTO>>> GetData(long userId)
{
    return _context.Data.Select(data => CreateDataDTO(data)).ToListAsync();
}

And according to this answer using the claim:

[HttpGet]
[Authorize]
public async Task<ActionResult<IEnumerable<DataDTO>>> GetData()
{
    //[...]
    var user = (System.Security.Claims.ClaimsIdentity)User.Identity;
    var userId = user.FindFirstValue("UserId");

    return _context.Data.Select(data => CreateDataDTO(data)).ToListAsync();
}

I might answer this myself by asking: is the only difference, that the one (claim) is getting encoded into a JWT Token, while the other (param) is readable by anyone observing the traffic?

Upvotes: 0

Views: 29

Answers (0)

Related Questions