I have .NET Core WebApi application with JWT token for authorization. I also have roles and permissions.
To make it more flexible for end user, I decided to make permissions like this:
[Authorize(Policy = "HasAccessToThisMethod")]
[Route("someMethod/{id}")]
[ProducesResponseType(typeof(int), 200)]
[HttpPost]
public async Task<IActionResult> SomeMethod(int id)
And store them in the tokens. With this approach, user can create whatever roles he/she wants and add permissions to them.
Recently, I had a problem with token size, it exceeded the default 16kb Windows/IIS limit. I increased it and called it a day, but after reading more about tokens I understood, that they usually are ~4kb.
Questions:
- How bad is this approach?
- Is it okay that token grows with permissions count?
- Is replacing
[Authorize]
with custom middleware would be better?- It would check the user's permissions according to his uid/role/etc and not keeping all permissions in token.
- If not, what solution is better?