Authorization based on metadata or structure
By default, the approach for setting authorization for controllers in ASP.NET Core uses the [Authorize] attribute or the fluent interface when registering controllers or endpoints. For some scenarios, this can be very explicit, and in applications with a large number of controller endpoints, you might want to consider securing them in a cross-cutting manner.
If sections of your application are just meant to be used by users with a given role, this could be a great candidate for applying security policies for all of these based on namespace. Through structure, we get the implicit metadata that follows the types, and we can use that as a way to make decisions for us.
To do this, we need to put in a few things. First of all, we need to have a mechanism for authenticating users. For this sample, we will use hardcoded users to avoid the complexity of having to set up proper authentication with an identity provider.
You’ll need...
