AuthorizationEvaluator should check authentication state about authorization HOT 7 CLOSED

Also seems odd that AuthorizeWith() and RequireAuthorization() extensions methods don't do any authorization checks by calling the internal Authorization evaluator and only check for claim matches.

from authorization.

The “next” branch adds an Authorization requirement that you can use to check for an authenticated user. You can add that requirement today in your own codebase if you wish.

5795fb5

from authorization.

Ahhhh...

.RequireAuthorization() is not to mark a type as requiring authorization. It is a convenience method for checking if any policies have been defined against the type using the .AuthorizeWith() method.

As such there is no method currently for flagging a type needs to be authorized but not against specific policies, correct?

I guess the requirement you suggest would still need to be registered against a policy and that policy used e.g. .AuthorizeWith("authenticated");

from authorization.

Yes. A policy could be anything, not only related to the authenticated user. Such as, maybe your policy checks a configuration value or something like that.

from authorization.

See #49 (comment)
for an example flow.

Once you get used to the setup, it's actually pretty straight forward.

from authorization.

@Vouzamo Is this issue still actual?

from authorization.

Closed due to inactivity.

from authorization.