Interface IUploadAuthorizationHandler
Optional per-file authorization for the built-in endpoints.
Default behavior (no implementation registered): the endpoints are capability-based - anyone holding a file's GUID can read or delete it. The GUIDs are NewGuid() (v4, not enumerable), so this is the same security model as an unguessable share link. That is a deliberate default so the component works with zero configuration, but it means a GUID leaked through a referrer header, a log, or a screenshot grants access.
To scope files to a user/tenant, register an implementation:
builder.Services.AddSingleton<IUploadAuthorizationHandler, MyUploadAuthorization>();
public sealed class MyUploadAuthorization : IUploadAuthorizationHandler
{
public ValueTask<bool> AuthorizeAsync(HttpContext http, Guid fileGuid, UploadFileAction action, CancellationToken ct)
{
var owner = MyDb.GetOwnerOf(fileGuid);
return ValueTask.FromResult(owner == http.User.Identity?.Name);
}
}
Returning false makes the endpoint answer 404 (not 403) so a caller cannot probe which GUIDs exist.
Note that DELETE also honors
CoreUploadOptions.EnableAntiforgery, which is off by default; turn it
on (or authorize here) if a leaked GUID must not be deletable cross-site.
Namespace: CoreUpload.Security
Assembly: CoreUpload.dll
Syntax
public interface IUploadAuthorizationHandlerMethods
AuthorizeAsync(HttpContext, Guid, UploadFileAction, CancellationToken)
Decides whether the current request may perform action
on fileGuid.
Declaration
ValueTask<bool> AuthorizeAsync(HttpContext http, Guid fileGuid, UploadFileAction action, CancellationToken ct = default)Parameters
| Type | Name | Description |
|---|---|---|
| HttpContext | http | |
| Guid | fileGuid | |
| UploadFileAction | action | |
| CancellationToken | ct |
Returns
| Type | Description |
|---|---|
| ValueTask<bool> |
AuthorizeSigningAsync(HttpContext, string, CancellationToken)
Decides whether the current request may obtain a cloud-storage signature.
The presign endpoints (/s3/*, /azure/*, /gcs/*) are
privileged: anyone who can call them can obtain credentials to write into
your bucket. They are not covered by AuthorizeAsync(HttpContext, Guid, UploadFileAction, CancellationToken) because no file
GUID exists yet at signing time.
The default returns true, preserving existing behavior. Prefer gating them with standard authorization where you can:
app.MapCoreUploadEndpoints().RequireAuthorization();and override this when the decision needs per-request logic (tenant quotas, a key prefix the user is allowed to write to, and so on).
Returning false answers 403.
Declaration
ValueTask<bool> AuthorizeSigningAsync(HttpContext http, string operation, CancellationToken ct = default)Parameters
| Type | Name | Description |
|---|---|---|
| HttpContext | http | The current request. |
| string | operation | The signing operation, e.g. |
| CancellationToken | ct | Cancellation token for the authorization operation. |
Returns
| Type | Description |
|---|---|
| ValueTask<bool> |