AuthorizationFilterContext is no longer available in HandleRequirementAsync()

[FeodorFitsner]

In ASP.NET Core 3.0 AuthorizationFilterContext is no longer available inside AuthorizationHandler.HandleRequirementAsync() method.

In 2.2 this method is used to work:

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CookieOrTokenAuthorizationRequirement requirement)
{
	if (context.Resource is AuthorizationFilterContext mvcContext)
	{
		if (mvcContext.Filters.Any(filter => filter is MyFilter))
		{
			context.Succeed(requirement);
			return Task.CompletedTask;
		}
	}
}

However, in 3.0 context.Resource is no longer AuthorizationFilterContext, but instead Microsoft.AspNetCore.Routing.RouteEndpoint.

What's recommended way of accessing action filters in 3.0 inside AuthorizationHandler?

[wu-yafeng]

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CookieOrTokenAuthorizationRequirement requirement)
{
	if (context.Resource is Endpoint endpoint)
	{
		if (endpoint.Metadata.OfType<IFilterMetadata>().Any(filter => filter is MyFilter))
		{
			context.Succeed(requirement);
			return Task.CompletedTask;
		}
	}
}

This is because when using endpoint routing in ASP.NET Core 3.0:

• Mvc will no longer add AuthorizeFilter to ActionDescriptor and ResourceInvoker will not call AuthorizeAsync()

see https://github.com/aspnet/AspNetCore/blob/90ab2cb965aeb8ada13bc4b936b3735ca8dd28df/src/Mvc/Mvc.Core/src/ApplicationModels/AuthorizationApplicationModelProvider.cs#L40

• Mvc will add all Filter as metadata to endpoint.Metadata

see https://github.com/aspnet/AspNetCore/blob/5561338cfecac5ca4b1dda2f09a7f66153d0b5fe/src/Mvc/Mvc.Core/src/Routing/ActionEndpointFactory.cs#L348

• instead by AuthorizationMiddleware call the AuthorizeAsync() and resouorce is Endpoint

see https://github.com/aspnet/AspNetCore/blob/5561338cfecac5ca4b1dda2f09a7f66153d0b5fe/src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs#L63

[FeodorFitsner]

Worked like a charm, thanks for the fast response!

[rybkov]

As it is breaking change for Preview 8 - will we have workaround or suggested solution on how to redirect to custom URL when authorization failed?