{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Mvc/issues/4890","repository_url":"https://api.github.com/repos/aspnet/Mvc","labels_url":"https://api.github.com/repos/aspnet/Mvc/issues/4890/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Mvc/issues/4890/comments","events_url":"https://api.github.com/repos/aspnet/Mvc/issues/4890/events","html_url":"https://github.com/aspnet/Mvc/issues/4890","id":161432319,"number":4890,"title":"Resource based authorization limitations","user":{"login":"TheTechArch","id":13309071,"avatar_url":"https://avatars.githubusercontent.com/u/13309071?v=3","gravatar_id":"","url":"https://api.github.com/users/TheTechArch","html_url":"https://github.com/TheTechArch","followers_url":"https://api.github.com/users/TheTechArch/followers","following_url":"https://api.github.com/users/TheTechArch/following{/other_user}","gists_url":"https://api.github.com/users/TheTechArch/gists{/gist_id}","starred_url":"https://api.github.com/users/TheTechArch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheTechArch/subscriptions","organizations_url":"https://api.github.com/users/TheTechArch/orgs","repos_url":"https://api.github.com/users/TheTechArch/repos","events_url":"https://api.github.com/users/TheTechArch/events{/privacy}","received_events_url":"https://api.github.com/users/TheTechArch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2016-06-21T13:09:07Z","updated_at":"2016-06-22T22:06:56Z","closed_at":null,"body":"Working on a POC for large asp.net core application where we have advanced requirements for authorization. We current have implemented the application in MVC5 and I find the MVC5 way to do resources based authorization to be better in some areas.  In MVC5 We have implemented an authorization attribute, that based on the attributes on the controller method, know which action to authorize against (read, write ++) and from route data on HttpContext, (that is available in the attribute) we find the resourceID. Based on this we call our decisionPoint to decide if user is authorized or not. \r\n\r\nThe advantages I see with this approach is\r\n\r\n1. The developer does not need to add authorization code inside controller method\r\n2. It is easier to review if authorization is set up correctly \r\n3. Lower risk to have an implementation error in the controller\r\n\r\nIf an AuthorizationHandler had access to HttpContext this could had been easily resolved with the requirements/handler architecture in ASP.Net Core\r\n\r\nIs there a way to get it?\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Mvc/issues/comments/227892098","html_url":"https://github.com/aspnet/Mvc/issues/4890#issuecomment-227892098","issue_url":"https://api.github.com/repos/aspnet/Mvc/issues/4890","id":227892098,"user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"created_at":"2016-06-22T22:06:56Z","updated_at":"2016-06-22T22:06:56Z","body":"Adding @HaoK as he understands the cookie middleware better than I.\r\n\r\nIf you're using the cookie middleware there are events, OnRedirectToLogin and OnRedirectToAccess denied which might serve.\r\n\r\nThere shouldn't be a performance hit in getting the context that way."}}
{"actor":{"display_login":"blowdart"}}