Custom Authentication mechanism in ASP.Net Core
<p>I need to authenticate my users using an external API from the login page. If the authentication from the external API succeed then I store at the session a AuthToken.</p>

<p>To check if the request is valid I have created the following Authorization Handler</p>

<pre><code>public class ExtApiStoreRequirement : IAuthorizationRequirement
{
}
public class ExtApiAuthorizationHandler : AuthorizationHandler&lt;ExtApiStoreRequirement&gt;
{

    IHttpContextAccessor _accessor;
    public ExtApiAuthorizationHandler(IHttpContextAccessor accessor)
    {
        _accessor = accessor;
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, ExtApiStoreRequirement requirement)
    {
        var authState = GET_AUTH_FROM_SESSION(_accessor.HttpContext.Session);


        if (authState!=null)
        {
            _accessor.HttpContext.Response.Redirect("/Account/Login");
            //context.Fail(); &lt;-- I removed that because it was responding an empty page
            context.Succeed(requirement);
        }
        else
            context.Succeed(requirement);

        return Task.CompletedTask;
    }
}
</code></pre>

<p>And I have registered this handler at my startup.cs</p>

<pre><code>  services.AddAuthorization(options =&gt;
        {
            options.AddPolicy("ExtApi",
                              policy =&gt; policy.Requirements.Add(new ExtApiStoreRequirement()));
        });
</code></pre>

<p>This approach is working but I don't feel confident because I have to call  <code>context.Succeed(requirement);</code> for the redirection to work. If I call <code>context.Fail()</code> then no redirection takes place and all I see is an empty page.</p>

<p>Is there any security issue with this approach or I will be safe using it?</p>