What is the correct implementation for custom IAuthorizationPolicyProvider regarding to caching of policies?

[sfadeev]

Comments from method DefaultAuthorizationPolicyProvider.GetPolicyAsync(...) (https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authorization/Core/src/DefaultAuthorizationPolicyProvider.cs#L69) says:

        // MVC caches policies specifically for this class, so this method MUST return the same policy per
        // policyName for every request or it could allow undesired access. It also must return synchronously.
        // A change to either of these behaviors would require shipping a patch of MVC as well.

But samples for custom IAuthorizationPolicyProvider from official docs (https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authorization/iauthorizationpolicyprovider.md#custom-iauthorizationpolicyprovider) does not cache resulting policies and always returns new instances.

So the question:

• What is the correct implementation for custom IAuthorizationPolicyProviders regarding to caching of policies? Should custom implementations inherits from default implementation DefaultAuthorizationPolicyProvider and cache policies in IOptions<AuthorizationOptions> options passed in constructor or it is not required for correct authorization workflow?

Thank you.

[Rick-Anderson]

@blowdart please review.

[blowdart]

@HaoK will know, I do not.

[HaoK]

That comment is not for other implementations, MVC does an explicit type check for DefaultAuthorizationPolicyProvider, so this isn't a concern for other implementations. Basically you can do whatever you want in terms of caching, that's just a note to ourselves for this class for perf.

[HaoK]

Basically there's fast checks that skip calling into the provider in MVC for our implementation, custom providers will be called every time

[sfadeev]

Thank you.