You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Authorization is the process that determines if the user has permission to access or use resources, and usually is coupled with authentication so that the server has some concept of who the user is before determining what the user can do.
12
+
</p>
13
+
<p>
14
+
The authorization is controlled by the <code>Authorize</code> filter which is responsible for enforcing the authorization policy on the endpoint action. It uses the <code>Authorization</code> service to evaluate the policy and decide which rule applies to the action. The rule can allow or deny access to the action based on various criteria.
15
+
</p>
16
+
<h3>Configuration</h3>
17
+
<p>
18
+
To use the authorization feature in your application, you need first to add the <code>Authorization</code> service to the dependency, which also depends on the <code>Authentication</code> service, and the code below shows a simple way to add this feature.
19
+
</p>
20
+
<pre><codeclass="language-php"><?php
21
+
22
+
namespace Application;
23
+
24
+
use DevNet\System\TimeSpan;
25
+
use DevNet\Web\Hosting\WebHost;
26
+
use DevNet\Web\Extensions\ApplicationBuilderExtensions;
27
+
use DevNet\Web\Extensions\ServiceCollectionExtensions;
28
+
29
+
class Program
30
+
{
31
+
public static function main(array $args = [])
32
+
{
33
+
$builder = WebHost::createDefaultBuilder($args);
34
+
$builder->register(function ($services) {
35
+
// The authentication service is needed for authorization service.
By default, applying the <code>Authorize</code> filter on the endpoint action without specifying any option will restrict the execution of that action only for authenticated users, as shown in the code example below.
return $this->content("The user was successfully created.");
106
+
}
107
+
}</code></pre>
108
+
<p>
109
+
Another way to restrict access to the controller's action method is to use the Authorize attribute on the entire controller class, which applies the Authorize filter to all the action methods in the controller. But, If you want to exclude some action methods from that, you can use the <code>Authorize("Anonymous")</code> attribute on those methods to override the class-level filter that requires the user to be authenticated and allow access to anyone.
110
+
</p>
111
+
<p>
112
+
In this example, the Authorize filter is applied to all controller methods except for the <code>register()</code> and <code>login()</code> methods.
113
+
</p>
114
+
<pre><codeclass="language-php"><?php
115
+
116
+
namespace Application\Controllers;
117
+
118
+
use DevNet\Web\Action\ActionController;
119
+
use DevNet\Web\Action\Filters\Authorize;
120
+
use DevNet\Web\Action\IActionResult;
121
+
use Application\Models\Configuration;
122
+
use Application\Models\Login;
123
+
use Application\Models\Registration;
124
+
125
+
#[Authorize]
126
+
class AccountController extends ActionController
127
+
{
128
+
public function index(): IActionResult
129
+
{
130
+
// code.
131
+
}
132
+
133
+
#[Authorize('Anonymous')]
134
+
public function register(Registration $form): IActionResult
135
+
{
136
+
// code.
137
+
}
138
+
139
+
public function settings(Configuration $form): IActionResult
140
+
{
141
+
// code.
142
+
}
143
+
144
+
#[Authorize('Anonymous')]
145
+
public function login(login $form): IActionResult
146
+
{
147
+
// code.
148
+
}
149
+
}</code></pre>
150
+
<br>
151
+
<h4>Authorization with a specific scheme</h4>
152
+
<p>
153
+
When your application uses multiple authentication methods, such as cookie-base and token-base authentications, you may need to control how your application grants access to its resources based on the authentication scheme, and you can do this by specifying the authentication scheme in the Authorize filter to select which authentication method should be used to authorize access to particular resources.
154
+
</p>
155
+
<p>
156
+
This example code authorizes only cookie-based authentication.
157
+
</p>
158
+
<pre><codeclass="language-php"><?php
159
+
160
+
namespace Application\Controllers;
161
+
162
+
use DevNet\Web\Action\ActionController;
163
+
use DevNet\Web\Action\Filters\Authorize;
164
+
use DevNet\Web\Action\IActionResult;
165
+
use DevNet\Web\Security\Authentication\AuthenticationScheme;
166
+
167
+
#[Authorize(AuthenticationScheme::CookieSession)]
168
+
class AccountController extends ActionController
169
+
{
170
+
public function index(): IActionResult
171
+
{
172
+
// code.
173
+
}
174
+
}</code></pre>
175
+
<p>
176
+
And the following example code authorizes only token-based authentication.
177
+
</p>
178
+
<pre><codeclass="language-php"><?php
179
+
180
+
namespace Application\Controllers;
181
+
182
+
use DevNet\Web\Action\ActionController;
183
+
use DevNet\Web\Action\Filters\Authorize;
184
+
use DevNet\Web\Action\IActionResult;
185
+
use DevNet\Web\Security\Authentication\AuthenticationScheme;
186
+
187
+
#[Authorize(AuthenticationScheme::JwtBearer)]
188
+
class AccountController extends ActionController
189
+
{
190
+
public function index(): IActionResult
191
+
{
192
+
// code.
193
+
}
194
+
}</code></pre>
195
+
<br>
196
+
<h3>Role-based Authorization</h3>
197
+
<p>
198
+
Role-based authorization is a method of regulating access to resources based on the roles of users within a system. It specifies roles that the current user must have as claims in order to access the requested resource.
199
+
</p>
200
+
<p>
201
+
For example, in the code below, only users with the role of Administrator can access the resources, in other words only users that have the claim "Role" with the value "Administrator" are accepted.
202
+
</p>
203
+
<pre><codeclass="language-php"><?php
204
+
205
+
namespace Application\Controllers;
206
+
207
+
use DevNet\Web\Action\ActionController;
208
+
use DevNet\Web\Action\Filters\Authorize;
209
+
use DevNet\Web\Action\IActionResult;
210
+
211
+
class AccountController extends ActionController
212
+
{
213
+
#[Authorize(roles: ['Administrator'])]
214
+
public function index(): IActionResult
215
+
{
216
+
return $this->content("Hello Administrator");
217
+
}
218
+
}</code></pre>
219
+
<br>
220
+
<h4>Authorization with multiple roles</h4>
221
+
<p>
222
+
Multiple roles can be specified as an array of strings using the named argument <code>roles:</code> in the Authorize attribute, and the user must have at least one of these roles to access the resources.
223
+
</p>
224
+
<pre><codeclass="language-php"><?php
225
+
226
+
namespace Application\Controllers;
227
+
228
+
use DevNet\Web\Action\ActionController;
229
+
use DevNet\Web\Action\Filters\Authorize;
230
+
use DevNet\Web\Action\IActionResult;
231
+
232
+
class AccountController extends ActionController
233
+
{
234
+
#[Authorize(roles: ['Administrator, Manager'])]
235
+
public function index(): IActionResult
236
+
{
237
+
return $this->content("Hello to either Administrator or Manager");
238
+
}
239
+
}</code></pre>
240
+
<p>
241
+
When applying multiple Authorize attributes, the associated resources can only be accessed if the user satisfies all specified roles, unlike the previous example, where the user only needs to have at least one of the roles.
242
+
</p>
243
+
<pre><codeclass="language-php"><?php
244
+
245
+
namespace Application\Controllers;
246
+
247
+
use DevNet\Web\Action\ActionController;
248
+
use DevNet\Web\Action\Filters\Authorize;
249
+
use DevNet\Web\Action\IActionResult;
250
+
251
+
class AccountController extends ActionController
252
+
{
253
+
#[Authorize(roles: ['Administrator'])]
254
+
#[Authorize(roles: ['Manager'])]
255
+
public function index(): IActionResult
256
+
{
257
+
return $this->content("Hello to Administrator and Manager");
258
+
}
259
+
}</code></pre>
260
+
<br>
261
+
<h3>Policy-based Authorization</h3>
262
+
<p>
263
+
Policy-based authorization is a way of creating authorization rules that depend on claims requirements that the user must satisfy to access a resource. It can require any user's claims such as ID, Name, Email, Role, etc., unlike role-based authorization, which is just a special case of policy-based authorization that only requires the role claim.
264
+
</p>
265
+
<p>
266
+
To use a policy in your application, you must first define it in the Authorization service by calling the addPolicy() method, which allows you to specify a group of claim requirements, as shown in the following example.
267
+
</p>
268
+
<pre><codeclass="language-php"><?php
269
+
270
+
namespace Application;
271
+
272
+
use DevNet\System\TimeSpan;
273
+
use DevNet\Web\Hosting\WebHost;
274
+
use DevNet\Web\Extensions\ApplicationBuilderExtensions;
275
+
use DevNet\Web\Extensions\ServiceCollectionExtensions;
0 commit comments