Implementing authorization in web applications and APIs

on YouTube ↗58m

" summary

Authentication is easy, authorization is hard — so separate identity tokens from permission decisioning and map users to roles and permissions per application. Built a reference implementation and a commercial product called Policy Server that evaluates claims + context and returns app-specific roles/permissions; integrates with ASP.NET Core via claims transformation or a custom policy provider. Demonstrations show the mapping and attribute- or programmatic-based enforcement work, while business rules stay in-app.

AI-written summary · about

" chapters (14)

1. 0:00Start
2. 3:33PolicyServer
3. 4:17Authorization is hard!
4. 8:13Observations
5. 12:27Modern Applications
6. 14:29Overloaded Security Token
7. 19:06Token Usage
8. 35:07ASP.NET Core Authorization Policies
9. 38:13Programmatically using policies
10. 43:18Custom Requirements
11. 44:05Requirement Handler
12. 45:23Using a custom Requirement
13. 47:56Global ASP.NET Core authorization policy
14. 49:53Resources

" related talks

• 01h 02mImplementing authorization in web applications and APIsDominick Baier · NDC Sydney 2017
• 58mImplementing Authorization in Web Applications and APIsDominick Baier, Brock Allen · NDC London 2018
• 56mImplementing authorization in web applications and APIsDominick Baier, Brock Allen · NDC Oslo 2017
• 54mAuthorization for modern ApplicationsDominick Baier · NDC Oslo 2018
• 01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...Michele Leroux Bustamante · NDC Security 2026
• 49mAuthorization for Modern ApplicationsDominick Baier · DevConf 2018
• 51mAuthentication and Authorization in ASP.NET Core 2Roland Guijt · Update Conference Prague 2018
• 29mWhy Authorization is HardSam Scott · PyCon US 2022