ASP.NET Core MVC Interview Question #181

How would you implement authorization when users can edit only their own records?

Senior Practical MVC Scenarios & Production Architecture Senior Advanced

Quick Interview Answer

Use resource-based authorization. Load the record, then ask IAuthorizationService whether the current user is allowed to perform the requested operation on that specific resource.

Detailed Explanation

Use resource-based authorization. Load the record, then ask IAuthorizationService whether the current user is allowed to perform the requested operation on that specific resource.

Do not rely on a hidden OwnerId field or simply compare a client-submitted user identifier. Ownership information must come from trusted server-side data.

Code Example

var article = await _articles.GetAsync(id, token);
if (article == null)
    return NotFound();

var auth = await _authorization.AuthorizeAsync(
    User, article, "CanEditArticle");

if (!auth.Succeeded)
    return Forbid();