An authorization requirement is a condition that must be satisfied before an authorization policy succeeds. In ASP.NET Core, a policy has one or more requirements, and every requirement must be satisfied. A requirement can have multiple handlers, giving it more than one way to succeed. section 24.4.1
Authorization happens before a protected endpoint executes. Routing selects the endpoint, authentication supplies the request’s ClaimsPrincipal, and AuthorizationMiddleware checks the endpoint’s authorization metadata against that user. If authorization fails, the endpoint does not run. An unauthenticated user receives a challenge; an authenticated user who lacks permission receives a forbid response. section 24.2 section 24.2.2
Figure 24.6 For a policy to be satisfied, every requirement must be satisfied. A requirement is satisfied if any of the handlers is satisfied.
The diagram shows the two combination rules: all requirements in a policy must succeed, but any one handler can satisfy a requirement. section 24.4.1
Protecting an airline lounge
A lounge policy requires a minimum age of 18 and permission to enter. The age handler can calculate age from a DateOfBirth claim. Either a Gold frequent-flyer claim or an employee-number claim can satisfy the entry requirement. A banned-from-lounge claim can explicitly fail authorization, even if another handler reports success. section 24.4 section 24.4.2 section 24.7
To create a custom requirement:
- Define a lightweight C# class implementing the marker interface IAuthorizationRequirement. Add a constructor property, such as a minimum age, when the condition needs a configurable value; requirements themselves do not use dependency injection. section 24.4.2
- Add requirement instances to a named policy with AddRequirements(), then apply that policy to a Razor Page or action with [Authorize("CanAccessLounge")]. section 24.4.2
- Implement and register AuthorizationHandler<T> handlers. Call context.Succeed(requirement) when a handler establishes success; otherwise, do nothing so another handler can succeed. Reserve context.Fail() for a condition that must override success. section 24.4.2 section 24.7
A simple claim check may need only RequireClaim() rather than custom classes. The same policies, requirements, and handlers also apply to minimal API endpoints, where a named policy can be attached with RequireAuthorization("CanCreate"). section 24.4 section 25.6
