ASP.NET Core Web API Interview Question #64

What is a custom authorization requirement and handler?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

A custom authorization requirement represents an authorization condition that cannot be expressed adequately with built-in role or claim checks. An AuthorizationHandler evaluates that requirement using the current authorization context.

Detailed Explanation

Handlers are useful for reusable business-aware permission rules, but they should remain focused on authorization rather than performing unrelated application workflows.

Code Example

public sealed class MinimumAgeRequirement(int age)
    : IAuthorizationRequirement
{
    public int Age { get; } = age;
}

public sealed class MinimumAgeHandler
    : AuthorizationHandler<MinimumAgeRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        MinimumAgeRequirement requirement)
    {
        // Evaluate trusted claims here.
        return Task.CompletedTask;
    }
}