---
title: SaifAuthorizeAttribute
summary: API reference for SaifAuthorizeAttribute.
status: draft
owner: SAIF Documentation
last_reviewed: 2026-09-17
library: SAIF.Framework.Web.Mvc
reference_type: package
---

# SaifAuthorizeAttribute

Sealed authorization filter that grants access when the current user satisfies any one of the roles declared on the attribute (`[SaifAuthorize("RoleA", "RoleB")]`), and otherwise logs a `SecurityException` and redirects to a hard-coded error URL.

## Purpose
- Sealed authorization filter that grants access when the current user satisfies any one of the roles declared on the attribute (`[SaifAuthorize("RoleA", "RoleB")]`), and otherwise logs a `SecurityException` and redirects to a hard-coded error URL.
- Depends on property-injected `IUserProfileService`, `ILogService`, and `IEnvironmentService`; see [security-authorization.md](../../security-authorization.md) for the authorization architecture.

## Context
- Namespace: `SAIF.Web.Mvc`
- Assembly/package: `SAIF.Framework.Web.Mvc (source-shipping NuGet package)`
- Kind: sealed class (MVC authorization filter)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| UserProfileService | `public IUserProfileService UserProfileService { get; set; }` | Property-injected service used to resolve the current system user and evaluate role membership. |
| LogService | `public ILogService LogService { get; set; }` | Property-injected service used to log denied authorization attempts. |
| EnvironmentService | `public IEnvironmentService EnvironmentService { get; set; }` | Property-injected service used to resolve the current user id. |
| SaifAuthorizeAttribute(params string[] roles) | `public SaifAuthorizeAttribute(params string[] roles)` | Declares the set of roles that satisfy authorization; an empty set authorizes everyone. |
| SaifAuthorizeAttribute(bool forceProductionRole, params string[] roles) | `public SaifAuthorizeAttribute(bool forceProductionRole, params string[] roles)` | Stores the declared role set (trimmed and comma-joined into `Roles`) and retains `forceProductionRole`, so that when `AuthorizeCore` later evaluates `user.IsAuthorized(role, forceProductionRole)` the downstream user-profile check is forced to evaluate production-role names regardless of the current runtime environment. |
| AuthorizeCore(HttpContextBase) | `protected override bool AuthorizeCore(HttpContextBase httpContext)` | Returns whether the current user satisfies any declared role; see the "Authorize a request against SAIF roles" operation. |
| HandleUnauthorizedRequest(AuthorizationContext) | `protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)` | Logs the denial and redirects to the error page; see the "Handle an unauthorized request" operation. |

## Behavioral notes
- Role satisfaction is OR semantics — any one satisfied role authorizes the request (see [BR-18](../../business-rules.md#br-18-access-granted-on-any-satisfied-role)).

## Constraints and usage notes
- The unauthorized redirect uses a hard-coded literal URL rather than `Constants.ErrorUrl`, so it will not track future changes to that constant.

## Sources
- `src/Web.Mvc/ActionFilters/SaifAuthorizeAttribute.cs`