dotnet / dotnet/AspNetCore.Docs

Clean up and modernize the authorization docs

Open
#35,801 7 comments 1 reaction 1 assignee Claimed by @guardrex View on GitHub
area-security aspnet-core/svc Blazor blazor/subsvc mvc/subsvc Pri1 razor-pages/subsvc security/subsvc seQUESTered
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 3h
Merged PRs (30d)
97

Description

The ASP.NET Core docs cover authorization docs in several different places. We have specific authentication & authorization topics for each tech and general authorization content a top-level authorization section:

- Top-level under Security and Identity: [Authorization section](https://learn.microsoft.com/aspnet/core/security/authorization)
- Blazor: [ASP.NET Core Blazor authentication and authorization](https://learn.microsoft.com/aspnet/core/blazor/security/)
- Minimal APIs: [Authentication and authorization in minimal APIs](https://learn.microsoft.com/aspnet/core/fundamentals/minimal-apis/security)
- SignalR: [Authentication and authorization in ASP.NET Core SignalR](https://learn.microsoft.com/aspnet/core/signalr/authn-and-authz)
- gRPC: [Authentication and authorization in gRPC for ASP.NET Core](https://learn.microsoft.com/aspnet/core/grpc/authn-and-authz)
- YARP: [YARP Authentication and Authorization](https://learn.microsoft.com/aspnet/core/fundamentals/servers/yarp/authn-authz)

However, there is a bunch of content in the authorization section that is specific to MVC, API Controllers, and Razor Pages. For consistency, this content should be consolidated into authn-and-authz docs that live under the corresponding areas for those technologies. In cases where we use these technologies to demonstrate general authorization concepts, we should instead use Minimal APIs & Blazor to demonstrate those concepts.

- [ ] 🦖 🚧 ***In-progress!*** 🚧 [Create an ASP.NET Core web app with user data protected by authorization](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/secure-data) - Update tutorial to Blazor. Move existing tutorial to RP authz node. Tracked by [35790](https://github.com/dotnet/AspNetCore.Docs/issues/35790).
- [x] 🦖 [Razor Pages authorization conventions in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/razor-pages-authorization) - Move to Razor Pages. Done on [36919](https://github.com/dotnet/AspNetCore.Docs/pull/36919).
- [x] 🦖 [Simple authorization in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/simple) - Tracked by [35816](https://github.com/dotnet/AspNetCore.Docs/issues/35816). Done on [36650](https://github.com/dotnet/AspNetCore.Docs/pull/36650).
- [x] 🦖 [Custom authorization policies with IAuthorizationRequirementData](https://learn.microsoft.com/aspnet/core/security/authorization/iard) - Update to use Minimal APIs. Done on [36866](https://github.com/dotnet/AspNetCore.Docs/pull/36866).
- [x] 🦖 [Role-based authorization in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/roles) - Update to use Minimal APIs. Done on [36885](https://github.com/dotnet/AspNetCore.Docs/pull/36855).
- [x] 🦖 [Claims-based authorization in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/claims) - Move content to MVC, Razor Pages. Update to use Minimal APIs. Done on [36937](https://github.com/dotnet/AspNetCore.Docs/pull/36937).
- [x] 🦖 [Policy-based authorization in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/policies) - Tracked by [35817](https://github.com/dotnet/AspNetCore.Docs/issues/35817). Done on [37231](https://github.com/dotnet/AspNetCore.Docs/pull/37231).
- [x] 🦖 [Custom Authorization Policy Providers using IAuthorizationPolicyProvider in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/iauthorizationpolicyprovider) - Small update to use Minimal APIs. Tracked by [37370](https://github.com/dotnet/AspNetCore.Docs/issues/37370). PR at [37379](https://github.com/dotnet/AspNetCore.Docs/pull/37379).
- [x] [Customize the behavior of AuthorizationMiddleware](https://learn.microsoft.com/aspnet/core/security/authorization/customizingauthorizationmiddlewareresponse) - Looks good in present form! 👍
- [x] [Dependency injection in requirement handlers in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/dependencyinjection) - Looks good in present form! 👍
- [x] 🦖 [Resource-based authorization in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/resourcebased) - Tracked by [35818](https://github.com/dotnet/AspNetCore.Docs/issues/35818). Done on [37097](https://github.com/dotnet/AspNetCore.Docs/pull/37097).
- [x] 🦖 [View-based authorization in ASP.NET Core MVC](https://learn.microsoft.com/aspnet/core/security/authorization/views) - Move to MVC. Tracked by [37088](https://github.com/dotnet/AspNetCore.Docs/issues/37088). Done on [37369](https://github.com/dotnet/AspNetCore.Docs/pull/37369).
- [x] 🦖 [Authorize with a specific scheme in ASP.NET Core](https://learn.microsoft.com/aspnet/core/security/authorization/limitingidentitybyscheme) - Tracked by [35819](https://github.com/dotnet/AspNetCore.Docs/issues/35819). Done on [37439](https://github.com/dotnet/AspNetCore.Docs/pull/37439).

We should then also link to the various authn-and-authz docs from the Security and Identity section.

---
[Associated WorkItem - 494905](https://dev.azure.com/msft-skilling/Content/_workitems/edit/494905)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.