We are designing an authorization mechanism for a Product API where users have their own claims.

The api has a patch request like this:

PATCH https://product-fcd.com/api/product -d {"Products": []} -h "AuthToken":"xyz"

In this request, the process goes like this:

  • Validate user from token - handled by an authentication middleware
  • Get user claims, get existing products, check if the user has permission for these products - handled by an authorization middleware
  • In controller, get existing products and patch them based on user input. (the user doesn't have to put all of the fields of a product)
  • Validate products internally (ie. BuyingPrice should be less the SellingPrice) and, finally, update them.

The entities:

Product:    
{
    "Id": "guid",
    "CategoryId": int,
    "Brand": "string",
    "SellingPrice": int,
    "BuyingPrice": int
}

UserClaims:    
{
    "UserId": "guid",
    "Claims":[
        {"CategoryId": 1, Access: true},
        {"CategoryId": 2, Access: false}
        {"CategoryId": 3, Access: true}
        {"Brand": "abc", Access: false}
    ]
}

The problem is, "Get Existing Products" step is required both in claim validation and patching. Because we should check if the user has claim on the product, and we should check if the latest state of the product is valid. We thought of a way that this step could be handled in a seperate middleware and store the "Existing Products" in the request context, then pass it from authroziation to the controller.

Can you suggest any other ways to handle this, or is this a good practice?

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.