Implementing Authorization in Web Applications and APIs

on YouTube ↗58m

" summary

A prototype becomes a production-ready authorization system that separates identity from permissions, arguing identity tokens must not carry app-specific permissions and showing how to map identities to roles and permissions at runtime. Implementations include PolicyServer (open source "policy server local"), a client library for ASP.NET Core, JSON policy files, claims transformation, a dynamic policy provider, a management UI and hierarchical resource/role mapping. The demo proves it works end to end, with a GitHub repo and a commercial edition launched minutes after the demo.

AI-written summary · about

" chapters (12)

1. 0:00Start
2. 2:06Authorization is hard!
3. 4:21Modern Applications
4. 6:32Overloaded Security Token
5. 10:31Token Usage
6. 28:27Augment the Claims Principal
7. 31:50ASP.NET Core Authorization Policies
8. 34:58Programmatically using policies
9. 37:42ASP.NET Core Policy Provider
10. 41:57Custom Requirements
11. 45:25Requirement Handler
12. 46:31Conclusion

" related talks

• 58mImplementing authorization in web applications and APIsBrock Allen · NDC Minnesota 2018
• 56mImplementing authorization in web applications and APIsDominick Baier, Brock Allen · NDC Oslo 2017
• 01h 02mImplementing authorization in web applications and APIsDominick Baier · NDC Sydney 2017
• 54mAuthorization for modern ApplicationsDominick Baier · NDC Oslo 2018
• 01h 07mGetting Authorization Right in .NET: Patterns, Pitfalls...Michele Leroux Bustamante · NDC Security 2026
• 49mAuthorization for Modern ApplicationsDominick Baier · DevConf 2018
• 51mAuthentication and Authorization in ASP.NET Core 2Roland Guijt · Update Conference Prague 2018
• 47mDeveloping Flexible Authorisation Capabilities in ASP.NET CoreJason Taylor · NDC London 2023