Resource based authorization with Identity
Hello, I have the following setup in my asp.net core project:
A
My identity user gets a role such as
I had the following ideas:
1. Put everything under the WorkspaceController and require a workspaceId for every request eg:
/workspaces/{workspaceId}/dataset/{datasetId}. This way the middleware automatically checks for the workspaceId and does the authorisation. HOWEVER, people could cheat and supply a workspaceId they have access to and a datasetId that they don't have access to and the authorization would still be granted since the authorization is only done on the workspaceId.
2. Still put everything under the WorkspaceController and request workspaceId but then implement a repository pattern on every model which always requires a workspaceId as a getter. Eg
3. As a last resort I was thinking about manually checking in every endpoint of every controller the relationship to the workspace. So basically querying the model, fetching the workspaceId and checking against user role. However, this would require a database request for every endpoint and is error prone since I might forget to do the check.
Does anyone know of a better strategy here?
A
WorkspaceDatasetsTransformsMy identity user gets a role such as
workspace_01_editorWorkspaceControllerI had the following ideas:
1. Put everything under the WorkspaceController and require a workspaceId for every request eg:
/workspaces/{workspaceId}/dataset/{datasetId}. This way the middleware automatically checks for the workspaceId and does the authorisation. HOWEVER, people could cheat and supply a workspaceId they have access to and a datasetId that they don't have access to and the authorization would still be granted since the authorization is only done on the workspaceId.
2. Still put everything under the WorkspaceController and request workspaceId but then implement a repository pattern on every model which always requires a workspaceId as a getter. Eg
GetDatasetByIdAndWorkspaceId3. As a last resort I was thinking about manually checking in every endpoint of every controller the relationship to the workspace. So basically querying the model, fetching the workspaceId and checking against user role. However, this would require a database request for every endpoint and is error prone since I might forget to do the check.
Does anyone know of a better strategy here?
