Authorize Tag Helper for ASP.NET Core

Originally posted to:

In ASP.NET Core, it’s easy to control access to Controllers and Action Methods using the [Authorize] attribute. This attribute provides a simple way to ensure only authorized users are able to access certain parts of your application. While the [Authorize] attribute makes it easy to control authorization for an entire page, the mechanism for controlling access to a section of a page is a little clumsy, involving the use of a the IAuthorizationService and writing C# based if blocks in your Razor code.

In this blog post, we build an Authorize tag helper that makes it easy to control access to any block HTML in a Razor view.

Authorize Tag Helper

The basic idea of this tag helper is to provide similar functionality to the [Authorize] attribute and it’s associated action filter in ASP.NET Core MVC. The authorize tag helper will provide the same options as the [Authorize] attribute and the implementation will be based on the authorize filter. In the MVC framework, the [Authorize] attribute provides data such as the names of roles and policies while the authorize filter contains the logic to check for roles and policies as part of the request pipeline. Let’s walk through the most common scenarios.

Simple Authorization

In it’s simplest form, adding the [Authorize] attribute to a controller or action method will limit access to that controller or action method to users who are authenticated. That is, only users who are logged in will be able to access those controllers or action methods.

With the Authorize tag helper, we will implement a similar behaviour. Adding the asp-authorize attribute to any HTML element will ensure that only authenticated users can see that that block of HTML.

<div asp-authorize class="panel panel-default">
<div class="panel-heading">Welcome !!</div>
<div class="panel-body">
If you're logged in, you can see this section

If a user is not authenticated, the tag helper will suppress the output of that entire block of HTML. That section of HTML will not be sent to the browser.

Role Based Authorization

The [Authorize] attribute provides an option to specify the role that a user must belong to in order to access a controller or action method. For example, if a user must belong to the Admin role, we would add the [Authorize] attribute and specify the Roles property as follows:

[Authorize(Roles = "Admin")]
public class AdminController : Controller
//Action methods here

The equivalent using the Authorize tag helper would be to add the asp-authorize attribute to an HTML element and then also add the asp-roles attribute specifying the require role.

<div asp-authorize asp-roles="Admin" class="panel panel-default">
<div class="panel-heading">Admin Section</div>
<div class="panel-body">
Only admin users can see this section. Top secret admin things go here.

You can also specify a comma separated list of roles, in which case the HTML would be rendered if the user was a member of any of the roles specified.

Policy Based Authorization

The [Authorize] attribe also provides an option to authorize users based on the requirements specified in a Policy. You can learn more about the specifics of this approach by reading the offical docs on Claims-Based Authorization and Custom-Policy Based Authorization. Policy based authorization is applied by specifying Policy property for the [Authorize] attribute as follows:

[Authorize(Policy = "Seniors")]
public class AdminController : Controller
//action methods here

This assumes a policy named Seniors was defined at startup. For example:

services.AddAuthorization(o =>
o.AddPolicy("Seniors", p =>
p.RequireAssertion(context =>
return context.User.Claims
.Any(c => c.Type == "Age" && Int32.Parse(c.Value) >= 65);


The equivalent using the Authorize tag helper would be to add the asp-authorize attribute to an HTML element and then also add the asp-policy attribute specifying the policy name.

<div asp-authorize asp-policy="Seniors" class="panel panel-default">
<div class="panel-heading">Seniors Only</div>
<div class="panel-body">
Only users age 65 or older can see this section. Early bird dinner coupons go here.

Combining Role and Policy Based Authorization

You can combine the role based and policy based approaches by specifying both the asp-roles and asp-policy attributes. This has the effect of requiring that the user meets the requiremnts for both the role and the policy. For example, the following would require that the usere were both a member of the Admin role and meets the requirements defined in the Seniors policy.

<div asp-authorize asp-roles="Admin" asp-policy="Seniors" class="panel panel-default">
<div class="panel-heading">Admin Seniors Only</div>
<div class="panel-body">
Only users who have both the Admin role AND are age 65 or older can see this section.

Implementation Details

The Authorize tag helper itself is fairly simple. The implementation will likely evolve after this blog post so you can check out the latest version here.

The tag helper implements the IAuthorizeData interface. This is the interface implemented by the Authorize attribute in ASP.NET Core. In the ProcessAsync method, the properties of IAuthorizeData are used to create an effective policy that is then evaluated against the current HttpContext. If the policy does not succeed, then the output of the tag helper is supressed. Remember that supressing the output of a tag helper means that the HTML for that element, including it’s children, will be NOT sent to the client.

[HtmlTargetElement(Attributes = "asp-authorize")]
[HtmlTargetElement(Attributes = "asp-authorize,asp-policy")]
[HtmlTargetElement(Attributes = "asp-authorize,asp-roles")]
[HtmlTargetElement(Attributes = "asp-authorize,asp-authentication-schemes")]
public class AuthorizationPolicyTagHelper : TagHelper, IAuthorizeData
private readonly IAuthorizationPolicyProvider _policyProvider;
private readonly IPolicyEvaluator _policyEvaluator;
private readonly IHttpContextAccessor _httpContextAccessor;

public AuthorizationPolicyTagHelper(IHttpContextAccessor httpContextAccessor, IAuthorizationPolicyProvider policyProvider, IPolicyEvaluator policyEvaluator)
_httpContextAccessor = httpContextAccessor;
_policyProvider = policyProvider;
_policyEvaluator = policyEvaluator;

/// <summary>
/// Gets or sets the policy name that determines access to the HTML block.
/// </summary>
public string Policy { get; set; }

/// <summary>
/// Gets or sets a comma delimited list of roles that are allowed to access the HTML block.
/// </summary>
public string Roles { get; set; }

/// <summary>
/// Gets or sets a comma delimited list of schemes from which user information is constructed.
/// </summary>
public string AuthenticationSchemes { get; set; }

public override async Task ProcessAsync(TagHelperContext context, TagHelperOutput output)
var policy = await AuthorizationPolicy.CombineAsync(_policyProvider, new[] { this });

var authenticateResult = await _policyEvaluator.AuthenticateAsync(policy, _httpContextAccessor.HttpContext);

var authorizeResult = await _policyEvaluator.AuthorizeAsync(policy, authenticateResult, _httpContextAccessor.HttpContext, null);

if (!authorizeResult.Succeeded)

The code in the ProcessAsync method is based on the AuthorizeFilter from ASP.NET Core MVC.

Try it out

You can see the Authorize tag helper in action on my tag helper samples site here. The sample site contains the examples listed in this blog post and also provides a way to log in as different users to test different scenarios.

The Authorize tag helper is also available on NuGet so you can use it in your own ASP.NET Core application.

dotnet add package TagHelperSamples.Authorization

Let me know what you think. Would you like to see this tag helper included in the next release of ASP.NET Core?

What’s Next?

If you choose to use the Authorize tag helper in your application, you should remember that hiding a section of HTML is not enough to fully secure your application. You also need to make sure that authorization is applied to any related controllers and action methods. The Authorize tag helper is meant to be used in conjugtion with the [Authorize] attribute, not as a replacement for it.

There are a couple more scenarios I would like to go through and I will address those in a future post. One of those is supporting different Authorization Schemes and the other resource based authorization. Of course, this project is all open source so feel free to jump in on GitHub.

The Monsters Weekly - Episode 109 - DbContext Pooling in Entity Framework Core 2.0

Entity Framework Core 2 was released recently. In today’s episode we explore a new feature called DbContext Pooling. See how enabling DbContext Pooling might magically make your ASP.NET Core application faster!

Related Links:
GitHub Repo -
Netling Load Testing Tool -
.NET Conf Video - What’s new in EF Core 2.0 -

                 (Section on DbContext Pooling starts at 10:55s)


The Monsters Weekly - Episode 108 - Using the LIKE operator in Entity Framework Core 2.0

Entity Framework Core 2 was released recently. In today’s episode we explore a new feature that allows us to specify the SQL Server LIKE operator when querying for entities.

Related Links:
GitHub Repo -

The Monsters Weekly - Episode 107 - Azure Key Vault

In this episode we take a look at how to retrieve secrets from Azure Key Vault for use in your ASP.NET Core application

The Monsters Weekly - Episode 106 - Global Query Filters in Entity Framework Core 2.0

Entity Framework Core 2 was released recently. In today’s episode we explore a new feature called Global Query Filters. See how query filters can be applied globally to easily support features such as soft delete and even multi-tenancy.

Episode Sponsor:
AppVeyor - Continuous Delivery Services for Windows Developers

Related Links:
Code from the show on GiHub


The Monsters Weekly - Episode 105 - SQL Injection attacks in Entity Framework Core 2.0

Entity Framework Core 2 was released recently. In today’s episode we explore a new feature which automatically paramaterizes SQL Queries when the FromSql method is used with an interpolated string. Monster Dave shows us exactly why parametrized queries are so important when querying using raw sql.

Episode Sponsor:
AppVeyor - Continuous Delivery Services for Windows Developers


Related Links:
EF Core Injection Samples by Nick Craver
FormattableString - MSDN


The Monsters Weekly - Episode 104 - Deploy Virtual Applications in Azure App Service

Did you know that you can deploy multiple applications to a single Web App in Azure App Service? In today’s episode, Dave explores this virtually unknown feature of Virtual Applications in Azure App Service. Learn how to create a virtual application and how to deploy your ASP.NET Core application to that virtual application. 

Episode Sponsor:
AppVeyor - Continuous Delivery Services for Windows Developers

The Monsters Weekly - Episode 103 - Setting Version Numbers on a Build Server

Setting assembly and product version numbers as part of your build process is easier now in .NET Core. In this episode, Dave shows us how to specify version numbers for .NET core assemblies and NuGet packages using command line parameters and how easily that can be integrated into build systems like AppVeyor.

Episode Sponsor:
AppVeyor - Continuous Deliver Services for Windows Developers


Previous Episodes:
Hosted ASP.NET Core Builds with AppVeyor
Continuous Deployment with AppVeyor
Deploying a NuGet package with AppVeyor

Related Content:
AppVeyor Docs - Environment Variables


The Monsters Weekly - Episode 102 - Structured Logging with Application Insights

In this episode, we’ll explore how to hook up Application Insights to your ASP.NET Core application using the really excellent Serilog.


Serilog - structured logging for .NET

Seq - structured log searching

Application Insights Serilog sink

Serilog connector for .NET Core Logging

The Monsters Weekly - Episode 100 - Checking in NuGet Packages

Should we be checking in NuGet packages? Do we want to ensure that we can reliably recreate builds at a later date or do package managers handle all of that for use? In this episode, we try and get to the bottom of this quandary. 

Paket package manager:

Yarn packages manager: