According to Domain Driven Design and Development In Practice:

Spring Security (a sub-project in Spring Portfolio) provides a fine-grained access control in both presentation (URL based) and domain (Method Level) layers of the application. The framework uses Spring's Bean Proxy to intercept method invocation and apply security constraints. It offers a role-based declarative security for Java objects using MethodSecurityInterceptor class. There is also instance level security in the form of Access Control Lists (ACL's) for domain objects to control the user access at the instance level.

The main advantage of using Spring Security for managing the authorization requirements in the domain model is that the framework has a non-invasive architecture so we can have a clean separation between the domain and security aspects. Also, the business objects are not cluttered with security implementation details. We can write common security rules in one place and apply them (using AOP techniques) wherever they need to be implemented.

My question is:

Is there a project like Spring Security for C# to help me writing common security rules in one place and apply them (using AOP techniques) wherever I need to be implemented.?


For the URL level there is the AuthorizeAttribute

For general methods there is PostSharp

But I would say that applying authorisation rules in this way to the domain layer and AOP in general are somewhat frowned upon these days.

There is also Aspect Oriented Programming with Spring.NET

  • Why is AOP frowned upon exactly? – Veysel Özdemir Jun 2 '18 at 0:13
  • I think because it can couple your various classes too tightly. say I label up myobject with serialisation attributes and authorisation attributes etc now they are tightly coupled, where if I instead pass it to a SerialiserService or implement ISerializable I can have loose coupling. – Ewan Jun 2 '18 at 16:10
  • I respectfully disagree. Decorating classes or methods with AOP attributes does not necessarily force the developer to couple them at all. I have used AOP (with Postsharp) for many projects without any problems. You can use them for tracing, logging, method result caching and of course authorization. However, I should also mention that using AOP for adding an ISerializable interface is not within the supported use cases of AOP (at least Postsharp). That I would consider a hack: support.sharpcrafters.com/discussions/questions/… – Veysel Özdemir Jun 4 '18 at 15:43
  • @VeyselÖzdemir are you saying that i can use Pserializable without referencing PostSharp.Serialization.PSerializableAttribute ? – Ewan Jun 4 '18 at 16:04
  • 1
    Are you saying that you can use ISerializable without referencing System.Runtime.Serialization? – Robert Harvey Jun 4 '18 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.