Implementing authorization in web applications and APIs

on YouTube ↗56m

" summary

Argues that puting permissions into signed tokens fails for changing permissions and ambiguous meanings, and builds a prototype authorization provider as an ASP.NET Core Web API plus a client library that returns mapped roles and permissions, supports claims transformation, a dynamic policy provider, custom requirement handlers and resource‑based checks; notes need for caching on the client and that the approach works well for API/feature gating but breaks down once authorization becomes deep business logic tied to object properties.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 1:30Authorization is hard!
3. 5:08Modern Applications
4. 7:42Overloaded Security Token
5. 10:09Token Usage
6. 22:57Client Integration Strategies
7. 30:59ASP.NET Core Authorization
8. 39:31Custom Requirements
9. 47:02Example: Patient Resource
10. 50:32Conclusion

" related talks

• 01h 02mImplementing authorization in web applications and APIsDominick Baier · NDC Sydney 2017
• 58mImplementing Authorization in Web Applications and APIsDominick Baier, Brock Allen · NDC London 2018
• 58mImplementing authorization in web applications and APIsBrock Allen · NDC Minnesota 2018
• 54mAuthorization for modern ApplicationsDominick Baier · NDC Oslo 2018
• 36mFlexible Authorisation with ASP.NET Core 7.0Jason Taylor · NDC Oslo 2023
• 01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...Michele Leroux Bustamante · NDC Security 2026
• 51mDeveloping Flexible Authorisation Capabilities in ASP NET CoreJason Taylor · NDC Melbourne 2022
• 47mDeveloping Flexible Authorisation Capabilities in ASP.NET CoreJason Taylor · NDC London 2023