WebAuthorize & User Access Control
Mastering Authentication, Role-Based Authorization Attributes, and Security Infrastructure in AUA
Enterprise Authentication & Authorization
Authentication and access control are critical pillars of secure software engineering. The AUA framework provides a robust user management module that empowers webmasters to define roles, assign granular permissions, and restrict resource access down to the individual controller action level with minimal performance overhead.
Using WebApiAuthorize Attribute
To enforce access control via WebApiAuthorize, each control or action must be registered in EUserAccess, and corresponding records (Name, Access Number, Description, and URL) must be seeded in the database UserAccess table.
[WebAuthorize(EUserAccess.AppUser)]
public IActionResult GetUserProfile()
{
// Action limited to users with AppUser access (ID = 1)
}Multi-Access Support: The attribute accepts multiple access levels; if a user satisfies at least one of the specified accesses, they are granted permission. Page titles are also automatically loaded based on the description configured in the User Access table.
Built-in Authorization Models in AUA
Specifies precise role/action-based access levels for controllers and actions.
Restricts resource access strictly to authenticated (logged-in) users.
Restricts actions and controllers to local calls originating directly on the server.
Provides public, unrestricted access to the designated action or controller.
Restricts resource access dynamically based on predefined IP address ranges.
Requires the caller to present a valid operational access token.
1. Authorization Attribute & EUserAccess Enum
Secure your Web API endpoints using the built-in [WebAuthorize] attribute mapped to the EUserAccess enum.
// 1. Enum Definition for Granular Access Levels
public enum EUserAccess : int
{
[Description("User Management Access")]
AppUser = 1,
[Description("Role Management Access")]
Role = 2
}
// 2. Controller Action Authorization Usage
[WebAuthorize(EUserAccess.AppUser)]
[HttpGet]
public async Task<ResultModel<AppUserDto>> GetByIdAsync(long id)
{
var result = await _appUserService.GetByIdAsync(id);
return Success(result);
}"If you think good architecture is expensive, try bad architecture."AUA Framework Philosophy