Backstory: We have an application that uses JWT tokens with Role claims for each user. Users will be authorized by Role on controller level with Authorize(Policy = "Some policy") attribute. User is connected to Organisation. When logged in, data about the Organisation is sent to the User and presented on frontend.
New request: Client wants to have same User account as a part of different Organisations. After login, frontend will receive User data as well as IDs of all Organisations it is part of. We are controlling login portals by selecting the Organisation from the dropdown in header.
User can have different authorization rules based on organisation it is part of. For example:
User A is part of Organisations B and C. There is an endpoint getOrgData(int orgId) and updateOrgData(OrgDTO dto). User A is admin in Organisation B, so they should have access to both endpoints, but they are only employee in Organisation C and they should NOT have access to update endpoint for that Organisation.
We tried implementing multiple access tokens with different Role claims for all associated Organisations. We would then switch the token in state, when User switches portal. This is not secure enough, because User can find JWT tokens in local storage, and make a request via HTTP client with token with higher privileges.
Is there a way to better secure this approach, or do something else?
We could send orgId and userId on every request and query the database in controller, then throw 401 if User is not associated with Organisation, but we would like not to make our controller code dirty. Is there a way to achieve this with .NET Authorize attribute?
