Asp.Net Core Identity - Authorize attribute with roles and caching?

HaukurHaf

I have a simple web application in ASP.Net Core with ASP.Net core Identity. I'm using role based authorization on various controllers and it seems to me that the Authorize attribute is not picking up changes to role membership right way.

Let's say I decorate a controller with the authorize attribute and specify a role, like this:

[Authorize(Roles = "TestRole")]

Then I log in as a user which is not in that role. I try to access the controller and the Authorize attribute correctly prevents me to access the controller - gives me an access denied error.

Then I add the user to the TestRole programmatically (I have built a simple user management GUI in the web app where I can manage users and roles). According to the GetRolesAsync() method, the user has successfully been added to the role and everything looks good if I check the records in the Identity tables in the DB. However, I still cannot access the controller - the Authorize attribute does not seem to be aware that the user is now in this role. The role information seems to be cached. If I wait long enough before trying again (a few hours maybe) then this appears to work correctly. If I kill the IIS express process and restart the website, this works immediately, suggesting that the role information is somehow being cached.

I have not been able to find anything which explicitly states that the Role information is indeed cached or how to disable it for that matter. When I change the role membership of users in my system I need the changes to be reflected right away.

Any ideas?

HaukurHaf

OK - how typical. I've been trying to wrap my head around this for a few days now and as soon as I finally post a question to SO, I find the answer :)

By default, ASP.Net Identity stores user's authorized roles inside Role Claim after user successful login. Those claims are stored inside cookie until user logout or close the browser.

Is it possible to cache authorizations in ASP.NET MVC & Identity 2.0?

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

ASP.NET Core Authorize attribute not working with JWT

Return HTTP 403 using Authorize attribute in ASP.Net Core

Authorize Attribute with Multiple Roles

ASP.NET MVC 4 Custom Authorize Attribute with Permission Codes (without roles)

Identity Authorize Attribute Roles with Web API

Dynamically add roles to authorize attribute for controller in ASP.NET 5

Using the Authorize Attribute with Custom Cookie Authentication in ASP.NET Core

What is the default behavior of violating the Authorize attribute in ASP.NET Core

Users Roles Permissions using ASP.NET Core Identity 3

Authorize Policy attribute always returns 403 forbidden using .net core Identity and JwtBearerAuthentication

ASP.NET Identity 2 hierarchical roles

ASP.NET Core 2 - Identity - DI errors with custom Roles

Why is ASP.NET Core Identity 2.0 Authorize filter causing me to get a 404?

.Net core Authorize attribute in inherited controller

Asp.Net Core WebApi: Authorize attribute Error 403

Authorize Register Page in ASP.NET Core 2.1 with Identity UI as a library

.net core identity 2.1 role authorize not working

How do I seed user roles in Identity ASP.NET Core 2.1 (Identity Scaffolded)

ASP.NET Core 3 API Ignores Authorize Attribute with Bearertoken

Using Asp.Net Core Identity in MVC, Authorize attribute is rebouncing to login page after succesfull login

Custom Authorize attribute - ASP .NET Core 2.2

Asp.Net Core Identity - simple Authorization without Roles table

Adding [Authorize] to controller failing to redirect to Identity Login route. ASP.NET CORE 3.1 MVC

Asp.net Core MVC Authorize Attribute not blocking

unable to add roles in asp.net identity

Generic Authorize Attribute multiple Roles ASP.NET Core

Authorize(Roles = "Admin") not working in .net core 3.0

Not Found for actions with Authorize attribute while using identity in asp.net core

.Net core Authorize attribute inheritance of roles from global to controller

TOP Ranking

  1. 1

    Failed to listen on localhost:8000 (reason: Cannot assign requested address)

  2. 2

    pump.io port in URL

  3. 3

    How to import an asset in swift using Bundle.main.path() in a react-native native module

  4. 4

    Loopback Error: connect ECONNREFUSED 127.0.0.1:3306 (MAMP)

  5. 5

    Compiler error CS0246 (type or namespace not found) on using Ninject in ASP.NET vNext

  6. 6

    BigQuery - concatenate ignoring NULL

  7. 7

    Spring Boot JPA PostgreSQL Web App - Internal Authentication Error

  8. 8

    ggplotly no applicable method for 'plotly_build' applied to an object of class "NULL" if statements

  9. 9

    ngClass error (Can't bind ngClass since it isn't a known property of div) in Angular 11.0.3

  10. 10

    How to remove the extra space from right in a webview?

  11. 11

    Change dd-mm-yyyy date format of dataframe date column to yyyy-mm-dd

  12. 12

    Jquery different data trapped from direct mousedown event and simulation via $(this).trigger('mousedown');

  13. 13

    maven-jaxb2-plugin cannot generate classes due to two declarations cause a collision in ObjectFactory class

  14. 14

    java.lang.NullPointerException: Cannot read the array length because "<local3>" is null

  15. 15

    How to use merge windows unallocated space into Ubuntu using GParted?

  16. 16

    flutter: dropdown item programmatically unselect problem

  17. 17

    Pandas - check if dataframe has negative value in any column

  18. 18

    Nuget add packages gives access denied errors

  19. 19

    Can't pre-populate phone number and message body in SMS link on iPhones when SMS app is not running in the background

  20. 20

    Generate random UUIDv4 with Elm

  21. 21

    Client secret not provided in request error with Keycloak

HotTag

Archive