Authorization user role is case sensitive
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
If I declare a required role for an authorization policy with `AuthorizationPolicyBuilder.RequireRole` or with the `Authorize(Roles="...")` attribute, the role name is taken untransformed.
If I add roles to a user with `UserManager<>.AddToRoleAsync` then the role name is transformed by `ILookupNormalizer` (actually the transformation is uppercasing) before passing the roles to `IUserRoleStore.AddToRoleAsync`.
Now, when the policy is evaluated to authorize a user, `ClaimsIdentity.HasClaim` is called to check if the user have the correct role:
```
public virtual bool HasClaim(string type, string value)
{
if (type == null)
{
throw new ArgumentNullException(nameof(type));
}
if (value == null)
{
throw new ArgumentNullException(nameof(value));
}
foreach (Claim claim in Claims)
{
if (claim != null
&& string.Equals(claim.Type, type, StringComparison.OrdinalIgnoreCase)
&& string.Equals(claim.Value, value, StringComparison.Ordinal))
{
return true;
}
}
return false;
}
```
This function is doing a case sensitive comparison of the claim value.
### Expected Behavior
The role transformation should be consistent across the API. `AuthorizeAttribute` and `AuthorizationPolicyBuilder.RequireRole` should transform the role name.
If it's working as intended then the documentation should be updated to reflect it.
### Steps To Reproduce
_No response_
### Exceptions (if any)
_No response_
### .NET Version
6.0.402
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.