ValidateHasRole vs RequireRole attributes

user_1836964 0
Viewed 37

What is the difference between attributes such as [RequireRole("admin")] and [ValidateHasRole("admin")]?

https://docs.servicestack.net/authentication-and-authorization#requiredrole-and-requiredpermission-attributes https://docs.servicestack.net/declarative-validation#type-validators

It does say in the docs:

ServiceStack includes built-in Type Validator attributes for all Authorization Filter Attributes but as they’re decoupled from any implementation they can be safely annotated on Request DTOs without requiring any implementation dependencies.

Which dependencies are those? As I understand, [RequireRole("admin")] can be put on the service or directly on the DTO.

servicestack
1 Answers

The [RequireRole] is implemented by the RequiredRoleAttribute.cs Request Filter Attribute in ServiceStack.dll.

Your ServiceModel project containing your API DTOs should not have any concrete implementation assemblies like ServiceStack.dll so if you want to annotate your Request DTOs with Authentication attributes you should use the declarative fluent validation [Vaidate*] instead which exists in the impl-free ServiceStack.Interfaces.dll - i.e. the only ServiceStack .dll your Service Models (DTOs) should reference.

user_857850
Related