Custom Authorization Handlers

Creating Custom Requirements

Custom requirements allow you to implement complex authorization logic beyond roles and claims.

public class MinimumAgeRequirement : IAuthorizationRequirement
{
    public int MinimumAge { get; }

    public MinimumAgeRequirement(int minimumAge)
    {
        MinimumAge = minimumAge;
    }
}

Creating Custom Handlers

public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        MinimumAgeRequirement requirement)
    {
        var birthDateClaim = context.User.FindFirst("BirthDate");
        
        if (birthDateClaim == null)
            return Task.CompletedTask;

        if (DateTime.TryParse(birthDateClaim.Value, out var birthDate))
        {
            var age = DateTime.Today.Year - birthDate.Year;
            
            if (age >= requirement.MinimumAge)
            {
                context.Succeed(requirement);
            }
        }

        return Task.CompletedTask;
    }
}

Dependency Injection in Handlers

public class ActiveSubscriptionHandler 
    : AuthorizationHandler<ActiveSubscriptionRequirement>
{
    private readonly InvenTrackDbContext _context;

    public ActiveSubscriptionHandler(InvenTrackDbContext context)
    {
        _context = context;
    }

    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        ActiveSubscriptionRequirement requirement)
    {
        var userId = context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        
        var hasActiveSubscription = await _context.Subscriptions
            .AnyAsync(s => s.UserId == userId && s.IsActive);

        if (hasActiveSubscription)
        {
            context.Succeed(requirement);
        }
    }
}

Registering Handlers

// Register handlers
builder.Services.AddSingleton<IAuthorizationHandler, MinimumAgeHandler>();
builder.Services.AddScoped<IAuthorizationHandler, ActiveSubscriptionHandler>();

// Create policies
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("Over18", policy =>
        policy.Requirements.Add(new MinimumAgeRequirement(18)));

    options.AddPolicy("ActiveSubscription", policy =>
        policy.Requirements.Add(new ActiveSubscriptionRequirement()));
});

Complete InvenTrack Example

public class BusinessHoursRequirement : IAuthorizationRequirement
{
}

public class BusinessHoursHandler : AuthorizationHandler<BusinessHoursRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        BusinessHoursRequirement requirement)
    {
        var currentHour = DateTime.Now.Hour;

        // Business hours: 9 AM - 5 PM
        if (currentHour >= 9 && currentHour < 17)
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}

// Usage in Program.cs
builder.Services.AddSingleton<IAuthorizationHandler, BusinessHoursHandler>();

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("BusinessHoursOnly", policy =>
        policy.Requirements.Add(new BusinessHoursRequirement()));
});

// Usage in Controller
[Authorize(Policy = "BusinessHoursOnly")]
public IActionResult CreateOrder()
{
    return View();
}

Key Takeaways

• IAuthorizationRequirement: Define custom requirement
• AuthorizationHandler: Implement authorization logic
• context.Succeed(): Mark requirement as satisfied
• Dependency injection: Inject services into handlers
• Singleton vs Scoped: Choose based on dependencies
• Flexible: Implement any authorization logic