How do you create a custom AuthorizeAttribute in ASP.NET Core?

👋 Hey there, tech enthusiasts! 🌟

So, you want to create a custom AuthorizeAttribute in ASP.NET Core and have stumbled upon a roadblock. Don't worry, I've got you covered! In this blog post, I'll walk you through the current approach to achieve this and provide solutions to common problems. Let's dive in! 🏊‍♂️

Understanding the Challenge 🧩

🤔 In previous versions of ASP.NET, we could simply override the AuthorizeCore(HttpContextBase httpContext) method to create a custom AuthorizeAttribute. However, things have changed in the latest ASP.NET Core versions. The AuthorizeCore method no longer exists in AuthorizeAttribute. So, the burning question is:

❓ How do we make a custom AuthorizeAttribute now?

🎯 To shed light on this, let's zoom in on your specific situation. You mentioned that you're receiving a session ID in the Header Authorization, and based on that ID, you need to determine the validity of a particular action.

The Solution 💡

To achieve your goal, you'll need to create a custom implementation of the IAuthorizationFilter interface. This interface provides methods to perform authorization logic before an action is executed.

Step 1: Implementing IAuthorizationFilter

✍️ Create a new class that implements the IAuthorizationFilter interface. Let's call it CustomAuthorizationFilter.

public class CustomAuthorizationFilter : IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationFilterContext context)
    {
        // Your authorization logic goes here ⚙️
    }
}

Step 2: Implementing Authorization Logic

✏️ Within the OnAuthorization method, you can access the HttpContext and perform your custom authorization logic. In your case, obtaining the session ID from the Authorization header.

public void OnAuthorization(AuthorizationFilterContext context)
{
    var sessionID = context.HttpContext.Request.Headers["Authorization"].ToString();

    // Perform your custom session validation using the sessionID 🚦
}

💡 TIP: You can also create a custom session validator service to encapsulate your session validation logic for better organization and maintainability.

Step 3: Applying the Custom Authorization Filter

🔌 Now that you have your CustomAuthorizationFilter, you need to apply it to your desired controller actions or globally to all actions by modifying the Startup.cs file.

To apply it to specific actions, decorate the action or controller with the TypeFilterAttribute, passing your CustomAuthorizationFilter as a parameter:

[TypeFilter(typeof(CustomAuthorizationFilter))]
public IActionResult MySecuredAction() 
{
    // Action logic goes here
}

To apply it globally to all actions, open Startup.cs, locate the ConfigureServices method, and add the following line:

services.AddControllers(options =>
{
    options.Filters.Add(new CustomAuthorizationFilter());
});

The Call-to-Action 🔔

🎉 Congratulations, you now have the knowledge to create a custom AuthorizeAttribute in ASP.NET Core! It's time to put it into action and start harnessing the power of custom authorization for your applications. 🚀

💬 Share your thoughts with me: Have you faced any challenges while implementing custom authorization in ASP.NET Core? How did you overcome them? Share your experience in the comments below and let's learn and grow together! 💪

🔁 And don't forget to share this blog post with your fellow developers who might find it helpful. Happy coding! 😉