ASP.NET Core Interview Question #137

What is resource-based authorization?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Resource-based authorization evaluates access using both the current user and the specific resource being accessed. It is useful when the decision depends on data loaded at runtime, such as whether the current user owns a document or may edit a particular order.

Detailed Explanation

Resource-based authorization evaluates access using both the current user and the specific resource being accessed. It is useful when the decision depends on data loaded at runtime, such as whether the current user owns a document or may edit a particular order.

Because the resource is often loaded after routing and model binding, the application can call IAuthorizationService directly instead of relying only on an Authorize attribute.

Code Example

var document = await _repository.GetAsync(id);

var result = await _authorizationService.AuthorizeAsync(
    User, document, "CanEditDocument");

if (!result.Succeeded)
    return Forbid();