dotnet / dotnet/aspnetcore

Authorization user role is case sensitive

Open
#44,713 2 comments 0 reactions 0 assignees View on GitHub
area-auth Docs
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

If I declare a required role for an authorization policy with `AuthorizationPolicyBuilder.RequireRole` or with the `Authorize(Roles="...")` attribute, the role name is taken untransformed.

If I add roles to a user with `UserManager<>.AddToRoleAsync` then the role name is transformed by `ILookupNormalizer` (actually the transformation is uppercasing) before passing the roles to `IUserRoleStore.AddToRoleAsync`.

Now, when the policy is evaluated to authorize a user, `ClaimsIdentity.HasClaim` is called to check if the user have the correct role:

```
public virtual bool HasClaim(string type, string value)
{
if (type == null)
{
throw new ArgumentNullException(nameof(type));
}

if (value == null)
{
throw new ArgumentNullException(nameof(value));
}

foreach (Claim claim in Claims)
{
if (claim != null
&& string.Equals(claim.Type, type, StringComparison.OrdinalIgnoreCase)
&& string.Equals(claim.Value, value, StringComparison.Ordinal))
{
return true;
}
}

return false;
}
```

This function is doing a case sensitive comparison of the claim value.

### Expected Behavior

The role transformation should be consistent across the API. `AuthorizeAttribute` and `AuthorizationPolicyBuilder.RequireRole` should transform the role name.

If it's working as intended then the documentation should be updated to reflect it.

### Steps To Reproduce

_No response_

### Exceptions (if any)

_No response_

### .NET Version

6.0.402

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.