Accessing AuthorizationFailureReason in policy based auth

Product

Hot Chocolate

Is your feature request related to a problem?

If using policy based auth with IAuthorizationHandler interface, there is a option to pass instance of AuthorizationFailureReason to the Fail method of AuthorizationHandlerContext. This object might contain futher details about failed auhtoirazion.

When HC returns unauthorized response it looks like this:
{ "errors": [ { "message": "The current user is not authorized to access this resource.", "locations": [ { "line": 2, "column": 3 } ], "path": ["welcome"], "extensions": { "code": "AUTH_NOT_AUTHENTICATED" } } ], "data": { "welcome": null } }

The solution you'd like

Include AuthorizationFailureReason.Message in the response or at least log it somewhere.

As of now there is only propert Succeeded of AuthorizationResult being used in DefaultAuthorizationHandler. Content of property Filaure of type AuthorizationFailure which holds AuthorizationFailureReasons and list of failed IAuhtoirazionRequirements is currently completely ignored.

Debugging system with dozens of auth requirements is pain when you have to debug the code in order to figure out which of the requirements was not met.

Start by reading DefaultAuthorizationHandler and trace how AuthorizationResult uses Succeeded while ignoring Failure, AuthorizationFailureReasons, and failed IAuthorizationRequirements. Determine the existing authorization response or logging entry point, then define completion as making AuthorizationFailureReason.Message available in the response or logging it without exposing inappropriate details.