abpframework/abp · error · AbpAuthorizationException

Volo.Authorization:010001

Volo.Authorization:010001

Error message

Authorization failed! Given policy has not granted.

What it means

Thrown by CheckAsync(this IAuthorizationService, AuthorizationPolicy policy) when IsGrantedAsync(policy) is false. Error code Volo.Authorization:010001 (GivenPolicyHasNotGranted). Unlike error 010002 this variant takes a compiled AuthorizationPolicy object (not a name) and carries no resource data.

Source

Thrown at framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs:164

    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, AuthorizationPolicy policy)
    {
        if (!await authorizationService.IsGrantedAsync(resource, policy))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="policy">The policy to evaluate.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, AuthorizationPolicy policy)
    {
        if (!await authorizationService.IsGrantedAsync(policy))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGranted);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy against the specified resource, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="requirements">The requirements to evaluate the policy against.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, IEnumerable<IAuthorizationRequirement> requirements)
    {
        if (!await authorizationService.IsGrantedAsync(resource, requirements))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementsHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

View on GitHub (pinned to 7ed43b1931)

Solutions

  1. Confirm the current principal has the roles/claims the policy RequireRole/RequireClaim calls demand.
  2. Ensure every requirement in the policy has a registered handler that can Succeed.
  3. If access should be allowed, inspect the policy builder chain for overly strict requirements.
  4. Switch to a named policy (CheckAsync(policyName)) for easier diagnosis if applicable.

Example fix

// before
var policy = new AuthorizationPolicyBuilder().RequireRole("Admin").Build();
await AuthorizationService.CheckAsync(policy); // throws 010001
// after: ensure user is Admin, or relax the policy appropriately
Defensive patterns

Strategy: validation

Validate before calling

if (!await authorizationService.IsGrantedAsync(compiledPolicy))
{
    // return 403 instead of letting CheckAsync throw
}

Type guard

null

Try / catch

try { await authorizationService.CheckAsync(policy); }
catch (AbpAuthorizationException ex) when (ex.Code == "Volo.Authorization:010001")
{ /* handle forbidden; no resource in scope */ }

Prevention

When it happens

Trigger: Calling authorizationService.CheckAsync(compiledPolicy) where the policy's requirements are not satisfied by the current principal (no resource in scope).

Common situations: User lacks a role/claim the policy requires; policy built with RequireRole/RequireClaim that the principal doesn't have; requirement handler registered but always denies; policy built at runtime with the wrong builder calls.

Related errors

AI-assisted analysis of abpframework/abp@7ed43b1931 (2026-08-13). Data as JSON: /api/errors/a7f975e63401a6ec. Report an issue: GitHub.