A practical look at security and identity in ASP.NET Core and Entity Framework Core
summary
Shows how ASP.NET Core Identity and EF Core enforce feature and data authorization by turning role assignments into packed enum permissions stored as compact claims, using UserClaimsPrincipalFactory to inject them and onValidatePrincipal with cookie tick checks to renew changed claims. Database isolation uses EF Core global query filters plus an IOwnedBy pattern to stamp owner IDs on SaveChanges and a hierarchical tenant data key for multi-tenant scoping, with feature-module permission stripping for paid add-ons.
AI-written summary · about
chapters (9)
- 0:00Intro
- 2:46Super-quick intro to ASP.NET Core identity
- 4:51The limitations of the current roles-based system
- 14:24Replacement of Roles-based system - overview
- 21:14The Role ToPermissions entity class
- 33:12Data level authorization
- 33:54Data authorization example: personal data
- 34:45Data authorization implementation: DbContext
- 46:07The end (useful links)
related talks
51mAuthentication and Authorization in ASP.NET Core 2
39mA guided tour of ASP.NET core security
01h 00mSecuring Multitenant Databases with Entity Framework Core
58mSecurity in ASP.NET Core 2.0
54mASP.NET Core Meets Owasp Top 10
59mASP.NET Core Authentication and Authorization - the Key Concepts
47mDeveloping Flexible Authorisation Capabilities in ASP.NET Core
52mSecuring Web Applications and APIs with ASP.NET Core 2.2 and 3.0