liveBook · Manning

Authorization handler

As explained in .NET in Action, Second Edition

An authorization handler is a component that evaluates an authorization requirement against the current user and resource context.

An authorization handler evaluates a requirement against the authenticated user's context and can mark that requirement as successful. ASP.NET Core invokes handlers through named authorization policies, allowing controller actions to require different access rules. section 9.6

OnlyMe policy

The OnlyMe policy requires authentication and adds OnlyMeRequirement. Its handler succeeds only when the preferred_username claim matches the permitted email. It deliberately does not mark the requirement as failed otherwise, because another handler may still satisfy it; explicit failure is reserved for rules that must reject the requirement. A hardcoded email demonstrates the mechanism but is unsuitable for production, where the allowed list and verified identity claim should come from a safe source. section 9.6

How .NET in Action, Second Edition covers it

How deep it goes
Implements requirement evaluation, success semantics, policy registration, and dependency-injection wiring, while warning against hardcoded production identity data.
Examples
Uses the OnlyMeRequirement, preferred_username claim, OnlyMe policy, and controller actions for reading and creating books.
What it assumes
Assumes familiarity with authenticated users, claims, controller authorization, and dependency injection.
What you can do after
Build custom ASP.NET Core authorization requirements and handlers, then apply them through named policies.
How it connects
Connects authorization policies, requirements, authentication schemes, claims, and authenticated users.
Cover of .NET in Action, Second Edition
liveBookmanning.com
Read .NET in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain authorization handler →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of .NET in Action, Second Edition. The section links point to the parts of the book it draws on.