title: IP based authorization policy with Attributes
body: <p>I'm trying to secure a REST API based on the client IP.</p>
  
  <p>Imagine a blog application with these request examples:</p>
  
  <pre><code>/post/list               // Everyone     should see the posts
  /post/create             // Only Authors should create a post
  /post/update/42          // Only Authors should update a post
  /post/delete/42          // Only Admins  should delete a post
  /comment/42/list         // Everyone     should see a post's comments
  /comment/42/create       // Everyone     should create a comment
  /comment/42/delete/1337  // Only Admins  should delete a comment
  </code></pre>
  
  <p>IP whitelists defined in <strong>appsettings.json</strong>:</p>
  
  <pre class="lang-json prettyprint-override"><code>"IpSecurity": {
    "Author": "123.456.789.43,123.456.789.44",
    "Admin": "123.456.789.42"
  }
  </code></pre>
  
  <p>Here are action examples with the according <code>RequireRole</code> attributes I'd like to implement:</p>
  
  <pre class="lang-cs prettyprint-override"><code>[HttpGet("post/list")]
  public List&lt;Post&gt; List()
  // ...
  
  [RequireRole("Author")]
  [HttpGet("post/create")]
  public StandardResponse Create([FromBody]Post post)
  // ...
  
  [RequireRole("Admin")]
  [HttpGet("post/delete/{id}")]
  public StandardResponse Delete(int id)
  // ...
  </code></pre>
  
  <p>Defined injectable from <strong>Startup</strong></p>
  
  <pre class="lang-cs prettyprint-override"><code>var IpSecurity = Configuration.GetSection("IpSecurity");
  services.Configure&lt;IpSecurityConfig&gt;(IpSecurity);
  </code></pre>
  
  <p>Does it sound like a good idea ?</p>
  
  <p>Should I do a custom authorization policy, a middleware and/or a filter for that ?</p>
  
  <p>How would I implement the <code>RequireRole</code> attribute ?</p>
  
  <hr>
  
  <p><a href="http://www.henrihietala.fi/limit-access-to-your-azure-web-app-by-ip-address-asp-net-core/" rel="nofollow noreferrer">This</a> gives an idea of how to implement an IP whitelist but since a middleware does not have access to the contextual action, I can't use attributes to define my requirements.</p>