Handling Multiple Scopes in ASP.NET Core

This article explains why the RequireClaim method in ASP.NET Core (ASP.NET) may fail to validate multiple scopes in an access token and provides steps to implement a custom authorization handler to resolve the issue. When an access token contains multiple scopes, they are often formatted as a single, space-separated string within the scope claim.

This article details how to properly handle these claims to ensure successful authorization.

• ASP.NET Core
• Auth0 Access Tokens
• Scope-based authorization

The ASP.NET RequireClaim method performs a literal string comparison against the entire value of a claim. If an access token contains multiple space-separated scopes, the process checks the whole string rather than each scope individually. Because it does not account for various scopes within a single claim, the validation fails when searching for a specific individual scope.

To comply with the space-separated scopes, implement a custom authorization handler within the application as an alternative to RequireClaim. Please take a look at the HasScopeHandler sample documentation for a proposed example implementation.

Alternatively, use Actions to include a custom claim with a single scope to the AccessToken. This way, it will be compatible with the standard RequireClaim method. While this may simplify code implementation, handling the logic within the application is generally preferred to avoid increased token claims and improve scalability.