title: Custom authorization attribute in .NET Core
body: <p>I'm building an API in .NET Core 1.1. I build a custom <code>User</code> object from <code>HttpContext.User</code> in a base controller that all of my other controllers inherit from, and I have authentication enabled by default (must be manually disabled with <code>[AllowAnonymous]</code> when necessary). The <code>User</code> object has an <code>IsAdmin</code> property. Right now I'm checking if the user is an admin at the top of each relevant function like below, but I feel like there must be a way to add a custom attribute to simplify and clean up this code.</p>
  
  <p>For reference, <code>User.IsAdmin</code> is shorthand for this:</p>
  
  <pre><code>bool.Parse(HttpContext.User.FindFirst("IsAdmin")?.Value)
  </code></pre>
  
  <p>Instead of this:</p>
  
  <pre><code>[HttpGet]
  public async Task&lt;IActionResult&gt; Get()
  {
      if (!User.IsAdmin)
          return Forbid();
  
      // logic
  }
  </code></pre>
  
  <p>I'd like this (or something similar):</p>
  
  <pre><code>[AdminOnly]
  [HttpGet]
  public async Task&lt;IActionResult&gt; Get()
  {
      // logic
  }
  </code></pre>
  
  <p>I tried looking at the <a href="https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authorization/AuthorizeAttribute.cs" rel="noreferrer">source for <code>[AuthorizeAttribute]</code></a> to try to build from, but it's just a shell and I don't know where the real magic happens.</p>
  
  <p>How can I accomplish this?</p>