An authorization requirement is a condition that must be satisfied for an authorization policy to succeed. ASP.NET Core represents custom requirements with IAuthorizationRequirement and evaluates them through authorization handlers. section 9.6
Use requirements to express policy conditions and keep their runtime behavior explicit:
- Attach a requirement to a named policy alongside RequireAuthenticatedUser and the required authentication scheme. section 9.6
- Implement the condition in an AuthorizationHandler<TRequirement>, inspecting claims or other authorization context. section 9.6
- Call context.Succeed(requirement) only when the condition is satisfied; leaving it unresolved allows other handlers to succeed it. section 9.6
- Avoid marking failure unless the requirement must explicitly fail, because conflicting handler outcomes leave the requirement failed. section 9.6
A claim-based OnlyMe requirement
Define OnlyMeRequirement as IAuthorizationRequirement and register it with the OnlyMe policy. Its handler finds the preferred_username claim and calls context.Succeed(requirement) when the value matches the permitted account. Apply the policy to create and update actions. Unauthenticated requests receive 401; authenticated requests that fail the requirement receive 403. A hardcoded email is suitable only for demonstrating the mechanism: production values should come from a safe, verified source. section 9.6
