You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Custom authorization policies with `IAuthorizationRequirementData` in ASP.NET Core MVC
3
+
ai-usage: ai-assisted
4
+
author: tdykstra
5
+
description: Learn how to specify requirements associated with the authorization policy in attribute definitions with the IAuthorizationRequirementData interface in ASP.NET Core MVC.
6
+
monikerRange: '>= aspnetcore-8.0'
7
+
ms.author: tdykstra
8
+
ms.date: 03/11/2026
9
+
uid: mvc/security/authorization/iard
10
+
---
11
+
# Custom authorization policies with `IAuthorizationRequirementData` in ASP.NET Core MVC
12
+
13
+
This article provides a demonstration on how to use <xref:Microsoft.AspNetCore.Authorization.IAuthorizationRequirementData> to define custom authorization policies in ASP.NET Core MVC. For general guidance on this subject, see <xref:security/authorization/iard>.
14
+
15
+
## Sample app
16
+
17
+
The MVC sample for this article is the [`AuthRequirementsData` sample app (`dotnet/AspNetCore.Docs.Samples` GitHub repository)](https://github.com/dotnet/AspNetCore.Docs.Samples/tree/main/security/authorization/AuthRequirementsData) ([how to download](xref:index#how-to-download-a-sample)). The sample app implements a minimum age handler for users, requiring a user to present a birth date claim indicating that they're at least 21 years old.
18
+
19
+
## Demonstration
20
+
21
+
Test the sample with [`dotnet user-jwts`](xref:security/authentication/jwt) and curl.
22
+
23
+
From the project's folder in a command shell, execute the following command to create a JWT bearer token with a birth date claim that makes the user over 21 years old:
Set the value of the token (where the `{TOKEN}` placeholder appears in the preceding output) aside for use later.
40
+
41
+
You can decode the token in an online JWT decoder, such as [`jwt.ms`](https://jwt.ms/) to see its contents, revealing that it contains a `birthdate` claim with the user's birth date:
42
+
43
+
```json
44
+
{
45
+
"alg": "HS256",
46
+
"typ": "JWT"
47
+
}.{
48
+
"unique_name": "guard",
49
+
"sub": "guard",
50
+
"jti": "6cd613ed",
51
+
"birthdate": "1989-01-01",
52
+
"aud": [
53
+
"https://localhost:5001",
54
+
"http://localhost:5000"
55
+
],
56
+
"nbf": 1773663513,
57
+
"exp": 1781612313,
58
+
"iat": 1773663515,
59
+
"iss": "dotnet-user-jwts"
60
+
}.[Signature]
61
+
```
62
+
63
+
Execute the command again with a `dateofbirth` value that makes the user under the age of 21:
Start the app in Visual Studio or with the `dotnet watch` command in a command shell:
72
+
73
+
```dotnetcli
74
+
dotnet watch
75
+
```
76
+
77
+
In a command shell, use the .NET CLI to execute the following `curl.exe` command to request the `api/greetings/hello` endpoint. Replace the `{TOKEN}` placeholder with the first JWT bearer token that you saved earlier:
The output indicates success because the user's birth date claim indicates that they're at least 21 years old:
84
+
85
+
```dotnetcli
86
+
HTTP/1.1 200 OK
87
+
Content-Type: text/plain; charset=utf-8
88
+
Date: Thu, 15 May 2025 22:58:10 GMT
89
+
Server: Kestrel
90
+
Transfer-Encoding: chunked
91
+
92
+
Hello {USER}!
93
+
```
94
+
95
+
Logging indicates that the age requirement was met:
96
+
97
+
<!-- DOC AUTHOR NOTE
98
+
99
+
The following block quote uses two spaces at the ends of lines (except the
100
+
last line) to create returns in the rendered content. Don't remove the two
101
+
spaces at the ends of the lines when editing the following content.
102
+
103
+
-->
104
+
105
+
> :::no-loc text="MinimumAgeAuthorizationHandler: Information: Evaluating authorization requirement for age >= 21":::
106
+
> :::no-loc text="MinimumAgeAuthorizationHandler: Information: Minimum age authorization requirement 21 satisfied":::
107
+
108
+
Re-execute the `curl.exe` command with the second token, which indicates the user is under 21 years old. The output indicates that the requirement isn't met. Access to the endpoint is forbidden (status code 403):
109
+
110
+
```dotnetcli
111
+
HTTP/1.1 403 Forbidden
112
+
Content-Length: 0
113
+
Date: Thu, 15 May 2025 22:58:36 GMT
114
+
Server: Kestrel
115
+
```
116
+
117
+
Logging indicates that the age requirement wasn't met:
118
+
119
+
<!-- DOC AUTHOR NOTE
120
+
121
+
The following block quote uses two spaces at the ends of lines (except the
122
+
last line) to create returns in the rendered content. Don't remove the two
123
+
spaces at the ends of the lines when editing the following content.
124
+
125
+
-->
126
+
127
+
> :::no-loc text="MinimumAgeAuthorizationHandler: Information: Evaluating authorization requirement for age >= 21":::
128
+
> :::no-loc text="MinimumAgeAuthorizationHandler: Information: Current user's DateOfBirth claim (2020-01-01) doesn't satisfy the minimum age authorization requirement 21":::
Copy file name to clipboardExpand all lines: aspnetcore/security/authorization/custom-authorization-policies-with-iauthorizationrequirementdata.md
+61-21Lines changed: 61 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,25 +1,28 @@
1
1
---
2
2
title: Custom authorization policies with `IAuthorizationRequirementData`
3
+
ai-usage: ai-assisted
3
4
author: tdykstra
4
5
description: Learn how to specify requirements associated with the authorization policy in attribute definitions with the IAuthorizationRequirementData interface.
5
-
ms.author: tdykstra
6
6
monikerRange: '>= aspnetcore-8.0'
7
-
ms.date: 5/16/2025
7
+
ms.author: tdykstra
8
+
ms.date: 03/11/2026
8
9
uid: security/authorization/iard
9
10
---
10
11
# Custom authorization policies with `IAuthorizationRequirementData`
11
12
12
13
Use the <xref:Microsoft.AspNetCore.Authorization.IAuthorizationRequirementData> interface to specify requirements associated with the authorization policy in attribute definitions.
13
14
15
+
This article uses a [Minimal API](xref:fundamentals/minimal-apis) endpoint within the app and focuses on testing JWT-based authorization. For a demonstration of similar guidance in an MVC app with a controller, see the <xref:mvc/security/authorization/iard>.
16
+
14
17
## Sample app
15
18
16
-
The complete sample described in this article is the [AuthRequirementsData sample app (`dotnet/AspNetCore.Docs.Samples` GitHub repository)](https://github.com/dotnet/AspNetCore.Docs.Samples/tree/main/security/authorization/AuthRequirementsData) ([how to download](xref:blazor/fundamentals/index#sample-apps)). The sample app implements a minimum age handler for users, requiring a user to present a birth date claim indicating that they're at least 21 years old.
19
+
The Blazor Web App sample for this article is the [`AuthRequirementsDataBWA` sample app (`dotnet/AspNetCore.Docs.Samples` GitHub repository)](https://github.com/dotnet/AspNetCore.Docs.Samples/tree/main/security/authorization/AuthRequirementsDataBWA) ([how to download](xref:index#how-to-download-a-sample)). The sample app implements a minimum age handler for users, requiring a user to present a birth date claim indicating that they're at least 21 years old.
17
20
18
21
## Minimum age authorize attribute
19
22
20
23
The `MinimumAgeAuthorizeAttribute` implementation of <xref:Microsoft.AspNetCore.Authorization.IAuthorizationRequirementData> sets an authorization age:
The `MinimumAgeAuthorizationHandler` is registered as a singleton <xref:Microsoft.AspNetCore.Authorization.IAuthorizationHandler> service in the app's `Program` file:
The `GreetingsController` displays the user's name when they satisfy the minimum age policy, using an age of 21 years old with the `[MinimumAgeAuthorize({AGE})]` attribute, where the `{AGE}` placeholder is the age:
48
+
A [Minimal API](xref:fundamentals/minimal-apis) endpoint is configured in the app's `Program` file with the <xref:Microsoft.AspNetCore.Builder.AuthorizationEndpointConventionBuilderExtensions.RequireAuthorization%2A> extension method and the `MinimumAgeAuthorizeAttribute`:
The endpoint displays the user's name when they satisfy the minimum age policy, using an age of 21 years old supplied to a `MinimumAgeAuthorizeAttribute` instance.
If the user's birth date claim indicates that they're at least 21 years old, the endpoint displays the greeting string, issuing a 200 (OK) status code. If the user is missing the birth date claim or the claim indicates that they aren't at least 21 years old, the greeting isn't displayed and a 403 (Forbidden) status code is issued.
48
60
49
-
If the user's birth date claim indicates that they're at least 21 years old, the controller displays the greeting string, issuing a 200 (OK) status code. If the user is missing the birth date claim or the claim indicates that they aren't at least 21 years old, the greeting isn't displayed and a 403 (Forbidden) status code is issued.
61
+
> [!NOTE]
62
+
> For MVC controller guidance that demonstrates the same behavior, see <xref:mvc/security/authorization/iard>.
50
63
51
64
JWT bearer authentication services are added in the app's `Program` file:
Start the app in Visual Studio or with the `dotnet watch` command in the .NET CLI.
140
+
Start the app in Visual Studio or with the `dotnet watch` command in a command shell:
141
+
142
+
```dotnetcli
143
+
dotnet watch
144
+
```
127
145
128
-
In the .NET CLI, execute the following `curl.exe` command to request the `api/greetings/hello` endpoint. Replace the `{TOKEN}` placeholder with the first JWT bearer token that you saved earlier:
146
+
In a command shell, use the .NET CLI to execute the following `curl.exe` command to request the `api/greetings/hello` endpoint. Replace the `{TOKEN}` placeholder with the first JWT bearer token that you saved earlier:
0 commit comments