title: .Net Core Authorization on data displaying on view
body: <p>I am trying add an authorization logic to my .net core web based application to allow only the author(recorded in each database record as username) allow for edit/delete kind of action, others only can read.</p>
  
  <p>I did some googling, seems Resource based authorization may suit my requirements:
  <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authorization/resourcebased?view=aspnetcore-2.1&amp;tabs=aspnetcore2x" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/authorization/resourcebased?view=aspnetcore-2.1&amp;tabs=aspnetcore2x</a></p>
  
  <p>Not sure if I need to write a lot of handlers to implement the logic as shown in this example?
  <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authorization/secure-data?view=aspnetcore-2.1" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/authorization/secure-data?view=aspnetcore-2.1</a></p>
  
  <p>My understanding, the logic is like:</p>
  
  <pre><code>If current login user == the created by user in database record
      Display edit/delete link.
      Allow access the edit/delete action method in Controller.
  Else
      Access is denied.
  </code></pre>
  
  <p>Should I follow what the sample code's way or write my own authorization class?
  And if it is simpler to write my own authorization logic class, how could I invoke the logic as attribute above edit/delete action method in the controller?</p>
  
  <p>Thank you.</p>