Creating Custom AuthorizeAttribute in Web API (.Net Framework) : <p>I'm using OAuth2.0 Owin (password grant) in my WebAPI.My initial token Response is like below</p>

<pre><code>{
    "access_token": "_ramSlQYasdsRTWEWew.....................",
    "token_type": "bearer",
    "expires_in": 17999,
    "permissions": {
        "user": [
            "Add",
            "Update",
            "Delete"
        ],
        "Product": [
            "Read",
            "Create"
        ]
    }
}
</code></pre>

<p>I've <a href="https://stackoverflow.com/a/49722037/7073340">customized</a> the response by creating a new Key called <code>permissions</code> which hold the privileges for the corresponding user.</p>

<p>From here I need to validate each Request from my <code>Resource server</code>,by checking whether the user has enough permissions to call the API using Authorize Attribute.</p>

<p>I found a similar example from <a href="https://stackoverflow.com/a/43788693/7073340">here</a> where it deals with Dot net Core, which is not suitable for my case.</p>

<p>The difficult part is that the <code>permission</code> JSON Key is itself making a complex with <code>ArrayList</code></p>

<pre><code>[CustomAuthorize(PermissionItem.Product, PermissionAction.Read)]
    public async Task&lt;IActionResult&gt; Index()
    {
        return View(Index);
    }

public class CustomAuthorize : AuthorizeAttribute {
    public AuthorizeAttribute (PermissionItem item, PermissionAction action) {
        //Need to initalize the Permission Enums
    }
    public override void OnAuthorization (HttpActionContext actionContext) {
        //Code to get the value from Permissions ArrayList and compare it with the Enum values
    }
}
</code></pre>

<p>The above is the idea I'm having. But due to the complexity of the <code>Permissions</code> Key and Enum comparison I'm couldn't able to move forward.</p>

<p>Also, there is a question like If the permission for User is Add as well as Update means I need to create two Attribute conditions before my Controller.</p>

<p>Like</p>

<pre><code>[CustomAuthorize(PermissionItem.User, PermissionAction.Add)]
[CustomAuthorize(PermissionItem.User, PermissionAction.Update)]
</code></pre>

<p>Which leads to adding more lines of Attributes. So Is there is any way to make it as in a single Conditions with <code>|</code> separated?</p>

<pre><code>[CustomAuthorize(PermissionItem.User, PermissionAction.Update|PermissionAction.Add)]
</code></pre>
