abpframework/abp · error · AbpAuthorizationException

Volo.Authorization:010004

Volo.Authorization:010004

Error message

Authorization failed! Given requirement has not granted for given resource: {ResourceName}

What it means

Thrown by CheckAsync(this IAuthorizationService, object resource, IAuthorizationRequirement requirement) when IsGrantedAsync(resource, requirement) is false. Error code Volo.Authorization:010004 (GivenRequirementHasNotGrantedForGivenResource), with ResourceName (the resource object) attached as data. This is the resource+requirement variant used for instance-level authorization (e.g. 'can edit THIS document').

Source

Thrown at framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs:135

    {
        if (!await authorizationService.IsGrantedAsync(policyName))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedWithPolicyName)
                .WithData("PolicyName", policyName);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific requirement for the specified resource, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="requirement">The requirement to evaluate the policy against.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, IAuthorizationRequirement requirement)
    {
        if (!await authorizationService.IsGrantedAsync(resource, requirement))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy against the specified resource, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="policy">The policy to evaluate.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, AuthorizationPolicy policy)
    {
        if (!await authorizationService.IsGrantedAsync(resource, policy))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

View on GitHub (pinned to 7ed43b1931)

Solutions

Ensure the current user actually satisfies the requirement (e.g. owns the resource, has the needed role for that instance).
Confirm the AuthorizationHandler<TRequirement, TResource> is registered and evaluates the resource correctly.
Pass the correct, non-null resource instance of the expected type.
If instance-level access is genuinely denied, surface a 403 to the caller.

Example fix

// before
await AuthorizationService.CheckAsync(doc, Requirements.Edit); // throws 010004
// after: ensure handler grants for owners
public class EditHandler : AuthorizationHandler<EditRequirement, Document> {
  protected override Task HandleRequirementAsync(
      AuthorizationHandlerContext ctx, EditRequirement req, Document doc) {
    if (doc.OwnerId == ctx.User.GetId()) ctx.Succeed(req);
    return Task.CompletedTask;
  }
}

Defensive patterns

Strategy: validation

Validate before calling

if (!await authorizationService.IsGrantedAsync(resource, requirement))
{
    // return 403 for this resource instead of throwing
}

Type guard

null

Try / catch

try { await authorizationService.CheckAsync(resource, requirement); }
catch (AbpAuthorizationException ex) when (ex.Code == "Volo.Authorization:010004")
{ /* handle forbidden for this resource instance */ }

Prevention

Register a resource-aware AuthorizationHandler<TRequirement, TResource> for each pair.
Pass the concrete, non-null resource instance of the expected type.
Use IsGrantedAsync to gate UI actions per resource.
Make instance ownership/status checks explicit in the handler.

When it happens

Trigger: Calling authorizationService.CheckAsync(document, new EditRequirement()) where the registered AuthorizationHandler for that requirement+resource type denies the current user for that specific resource instance.

Common situations: Resource belongs to another user/tenant; requirement handler enforces ownership or status that the current principal fails; handler not registered or mis-scoped; resource passed is null/wrong type so the handler falls through to deny.

Related errors

AI-assisted analysis of abpframework/abp@7ed43b1931 (2026-08-13). Data as JSON: /api/errors/e73e2c650fa2e606. Report an issue: GitHub.