7 Types of authorization in ASP.NET Core Web API
- Many developers are stuck in 1 or 2 types of authorization: simple and RBAC.
- But did you know there are 5 more types of authorization in ASP .NET Core Web API?
Here is the complete list:
- 1. Simple Authorization
- 2. Role-based Authorization
- 3. Policy-based Authorization
- 4. Claims-based Authorization
- 5. Custom-requirement Authorization
- 6. Endpoint-specific Authorization
- 7. Resource-specific Authorization
1. Simple Authorization:
- (Simple authentication check using [Authorize])
- Uses the [Authorize] attribute to restrict access to authenticated users.
- Only checks whether the user is logged in or authenticated.
- Does not check roles, claims, or policies.
- Applied on controllers or individual API actions.
- Works with authentication systems like JWT, Cookies, or Identity.
- Best for basic security where only logged-in users can access endpoints.
2. Role-based Authorization:
- (Control access based on user roles)
- Uses the [Authorize(Roles = "RoleName")] attribute.
- Access is granted only if the user belongs to the specified role.
- Common roles include Admin, Manager, User, Moderator.
- Supports multiple roles using comma separation.
- Roles are usually stored in Identity or JWT tokens.
- Helps implement hierarchical permission systems.
- Example: Only Admin role can delete or update data.
3. Policy-based Authorization:
- (Authorization using defined policies)
- Uses authorization policies defined in Program.cs or Startup.cs.
- Policies are added using AddAuthorization().
- Policies can include multiple rules or requirements.
- Applied using [Authorize(Policy = "PolicyName")].
- More flexible than role-based authorization.
- Supports combining roles, claims, and custom logic.
- Useful for complex access control scenarios.
4. Claims-based Authorization:
- (Authorization based on user claims)
- Uses claims inside the authentication token.
- Claims represent user information like email, department, age, etc.
- Access decisions are based on specific claim values.
- Implemented using User.HasClaim() or policies.
- Claims are usually stored in JWT tokens or Identity.
- Allows fine-grained authorization control.
- Example: Only users with claim Department = HR can access an endpoint.
5. Custom-requirement Authorization:
- (Custom authorization logic using handlers)
- Used when default authorization methods are not enough.
- Developers create custom requirements and handlers.
- Implemented using IAuthorizationRequirement.
- Logic is written in AuthorizationHandler classes.
- Registered in the dependency injection container.
- Allows checking complex business rules.
- Example: Allow access only if user owns a resource or meets special conditions.
6. Endpoint-specific Authorization:
- (Authorization applied directly to endpoints)
- Authorization is applied directly to specific API endpoints.
- Works well with Minimal APIs in ASP.NET Core.
- Uses methods like RequireAuthorization().
- Allows applying policies or roles per endpoint.
- Provides fine control over individual routes.
- Keeps authorization close to route definitions.
- Useful for microservices and lightweight APIs.
7. Resource-specific Authorization:
- (Authorization based on a specific resource)
- Checks if the user has permission to access a specific resource instance.
- Often used for ownership-based access control.
- Implemented using IAuthorizationService.
- Requires loading the resource before authorization check.
- Authorization handler evaluates user and resource together.
- Common in scenarios like editing a specific document or record.
- Example: A user can edit only their own orders or posts.