Working with authorization and permission systems

Authentication and authorization are two major concepts in software security. Authentication is the process of identifying the current user. On the other hand, authorization is used to allow or prohibit a user from performing a specific action in the application.

ASP.NET Core's authorization system provides an advanced and flexible way to authorize the current user. ABP Framework's authorization infrastructure is 100% compatible with ASP.NET Core's authorization system and extends it by introducing the permission system. ABP allows permissions to be easily granted to roles and users. It allows the same permissions to be checked on the client side too.

I will explain the authorization system as a mix of ASP.NET Core's and ABP's infrastructure by indicating which part is added by ABP Framework. Let's begin with the simplest authorization check.

Simple authorization

In the simplest case, you may...