title: .Net Core 3 AuthorizationFilter for Each IActionResult
body: <p>From my research, I know (believe) I need an <code>AuthorizationFilter</code>, but I'm not clear on actual implementation.</p>
  <p>In my .Net Core 3.1 MVC app, I've created users and roles. I've added the ability for a <code>User</code> or a <code>Role</code> to have <code>Claims</code>. I built a <code>ManageClaims</code> (one for users and one for roles) view which lists each controller and their <code>IActionResult</code>'s as a <code>Claim</code>.</p>
  <p>I get the list like this:</p>
  <pre><code>var controllers = Assembly.GetExecutingAssembly().GetTypes()
                      .Where(type =&gt; typeof(Controller).IsAssignableFrom(type))
                      .SelectMany(type =&gt; type.GetMethods(BindingFlags.Instance | BindingFlags.DeclaredOnly | BindingFlags.Public))
                      .Where(m =&gt; !m.GetCustomAttributes(typeof(System.Runtime.CompilerServices.CompilerGeneratedAttribute), true).Any())
                      .Select(x =&gt; new { Type = x.DeclaringType.Name, Value = x.Name })
                      .OrderBy(x =&gt; x.Type).ThenBy(x =&gt; x.Value)
                      .Distinct()
                      .ToList();
  </code></pre>
  <p><code>Claims</code> look like this:</p>
  <pre><code>Claim Type              Claim Value
  -----------------------------------
  HomeController          Index
  HomeController          Privacy
  HomeController          Error
  UsersController         Index
  UsersController         Create
  UsersController         Details
  UsersController         Edit
  UsersController         Delete
  ...
  </code></pre>
  <p>What I'm trying to do is add a simple <code>Attribute</code> to either the <code>Controller</code> or each <code>IActionResult</code> (depending on my needs for a specific controller) to check if the user has a claim to that controller's method. Similar to this <a href="https://stackoverflow.com/a/50719054/286618">https://stackoverflow.com/a/50719054/286618</a> however I don't want to provide any parameters. Instead I want the authorization to figure out what's being access and then figure out if they have a claim to it.</p>
  <p>This allows me to grant/remove access to a controller's method on the fly for a user or role without having to hard code any policy's etc.</p>
  <p>Any feedback on this methodology is welcome as well.</p>
  <p>Thank you.</p>