title: ASP.NET Core custom Authorization always allows user
body: <p>I am trying to make a custom authorization system I am following the answer given by Shawn here <a href="https://stackoverflow.com/questions/31464359/how-do-you-create-a-custom-authorizeattribute-in-asp-net-core">How do you create a custom AuthorizeAttribute in ASP.NET Core?</a>. However, I have a problem getting it to work.</p>
  <p>Here are my custom class for the authorization</p>
  <pre class="lang-cs prettyprint-override"><code>    public abstract class AttributeAuthorizationHandler&lt;TRequirement, TAttribute&gt; : AuthorizationHandler&lt;TRequirement&gt; where TRequirement : IAuthorizationRequirement where TAttribute : Attribute
      {
          protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TRequirement requirement)
          {
              var attributes = new List&lt;TAttribute&gt;();
  
              var action = (context.Resource as AuthorizationFilterContext)?.ActionDescriptor as ControllerActionDescriptor;
              if (action != null)
              {
                  attributes.AddRange(GetAttributes(action.ControllerTypeInfo.UnderlyingSystemType));
                  attributes.AddRange(GetAttributes(action.MethodInfo));
              }
  
              return HandleRequirementAsync(context, requirement, attributes);
          }
  
          protected abstract Task HandleRequirementAsync(AuthorizationHandlerContext context, TRequirement requirement, IEnumerable&lt;TAttribute&gt; attributes);
  
          private static IEnumerable&lt;TAttribute&gt; GetAttributes(MemberInfo memberInfo)
          {
              return memberInfo.GetCustomAttributes(typeof(TAttribute), false).Cast&lt;TAttribute&gt;();
          }
      }
  
  
      public class PermissionAttribute : AuthorizeAttribute
      {
          public string Name { get; }
  
          public PermissionAttribute(string name) : base(&quot;Permission&quot;)
          {
              Name = name;
          }
      }
  
      public class PermissionAuthorizationHandler : AttributeAuthorizationHandler&lt;PermissionAuthorizationRequirement, PermissionAttribute&gt;
      {
          private readonly IEmployeeService _employeeMenuService;
  
          public PermissionAuthorizationHandler(IEmployeeService employeeMenuService)
          {
              _employeeMenuService = employeeMenuService;
          }
  
  
          protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionAuthorizationRequirement requirement, IEnumerable&lt;PermissionAttribute&gt; attributes)
          {
              foreach (var permissionAttribute in attributes)
              {
                  if (!await AuthorizeAsync(context.User, permissionAttribute.Name))
                  {
                      return;
                  }
              }
  
              context.Succeed(requirement);
          }
  </code></pre>
  <p>I believe that changes the return true to return false would block the page but it does not work.</p>
  <pre class="lang-cs prettyprint-override"><code>        private async Task&lt;bool&gt; AuthorizeAsync(ClaimsPrincipal user, string permission)
          {
              //Implement your custom user permission logic here
  
              await _employeeMenuService.GetAllEmployees();
  
              return true; 
          }
      }
      public class PermissionAuthorizationRequirement : IAuthorizationRequirement
      {
          //Add any custom requirement properties if you have them
      }
  </code></pre>
  <p>Here is the controller that I want to block</p>
  <pre class="lang-cs prettyprint-override"><code>    [Permission(&quot;fichacliente&quot;)]
      public class fichaClienteController : Controller
      {
      }
  </code></pre>
  <p>Finaly here is my startup code.</p>
  <pre class="lang-cs prettyprint-override"><code>            services.AddTransient&lt;IAuthorizationHandler, PermissionAuthorizationHandler&gt;();
  
              services.AddAuthorization(options =&gt;
              {
                  options.AddPolicy(&quot;Permission&quot;, policyBuilder =&gt;
                  {
                      policyBuilder.Requirements.Add(new PermissionAuthorizationRequirement());
                  });
              });
  </code></pre>