How to implement Permission Based Access Control with Asp.Net Core
<p>I am trying to implement permission based access control with aspnet core. For dynamically managing user roles and permissions(create_product, delete_product etc.), they are stored in the database. Data Model is like <a href="https://i.stack.imgur.com/CHMPE.png" rel="noreferrer">http://i.stack.imgur.com/CHMPE.png</a> </p>

<p>Before aspnet core (in MVC 5) i was using custom <code>AuthorizeAttribute</code> like below to handle the issue:</p>

<pre><code>public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    private readonly string _permissionName { get; set; }
    [Inject]
    public IAccessControlService _accessControlService { get; set; }

    public CustomAuthorizeAttribute(string permissionName = "")
    {
        _permissionName = permissionName;
    }

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);
        var user = _accessControlService.GetUser();
        if (PermissionName != "" &amp;&amp; !user.HasPermission(_permissionName))
        {
            // set error result
            filterContext.HttpContext.Response.StatusCode = 403;
            return;
        }
        filterContext.HttpContext.Items["CUSTOM_USER"] = user;
    }
}
</code></pre>

<p>Then i was using it in action method like below:</p>

<pre><code>[HttpGet]
[CustomAuthorize(PermissionEnum.PERSON_LIST)]
public ActionResult Index(PersonListQuery query){ }
</code></pre>

<p>Additionally, i was using HttpContext.Items["CUSTOM_USER"] in views to show or hide html part:</p>

<pre><code>@if (CurrentUser.HasPermission("&lt;Permission Name&gt;"))
{

}
</code></pre>

<p>When i decided to switch aspnet core, all my plan was failed. Because there was no virtual <code>OnAuthorization</code> method in the <code>AuthorizeAttribute</code>. I tried some ways to solve problem. Those are below:</p>

<ul>
<li><p>Using new policy based authorization(i think it is not suitable for
my scenerio)</p></li>
<li><p>Using custom <code>AuthorizeAttribute</code>  and <code>AuthorizationFilter</code>(i read this
post  <a href="https://stackoverflow.com/a/35863514/5426333">https://stackoverflow.com/a/35863514/5426333</a> but i couldn’t change it properly)</p></li>
<li><p>Using custom middleware(how to get <code>AuthorizeAttribute</code> of current
action?)</p></li>
<li><p>Using ActionFilter(is it correct for security purpose?)</p></li>
</ul>

<p>I couldn’t decide which way is the best for my scenerio and how to implement it.</p>

<p><strong>First question</strong>: Is MVC5 implementation bad practice?</p>

<p><strong>Second question</strong>: Do you have any suggest to implement aspnet core?</p>