Suggested practice for using MediatR and authorization?

Heads Up: this is similar/inspired by issue #433

---

I’m wondering if there’s a suggested practice for handling Authorization within an ASP.NET Core Web App that is using MediatR.

Authentication -> who are you? This is handled by the [Authorize] attribute on a controller (for example). I personally like using JWT’s as the payload with some JWT middleware deserializing the JWT content into a ClaimsPrincipal.

Authorization -> (now that I know who you are) What are you allowed to do/access? Not sure where this should be handled. In the controller action method? Or in the Handler method?

What are people doing and any sample code for reference, please?

I usually like to think of my controllers as really thin as possible and place logic in the Handlers.

Anyone have some info which they can suggest?

[damikun]

If you are looking for concrete implementation of authorization behavior follow json sources… https://github.com/jasontaylordev/CleanArchitecture/blob/main/src/Application/Common/Behaviours/AuthorizationBehaviour.cs

[lilasquared]

Pipeline behaviors are different now than they were in that blog post, there are some examples of them in the src of this project. Yes they have to be wired up, and yes aspnet core middleware is very similar. The difference is where you want your business logic to reside and what you want it to depend on. In the case of an aspnet core project you may be fine with all the aspnet core dependencies. In some cases people like their business logic to not have these dependencies so creating their own pipeline is preferred. It’s up to you how you use the tools.