abpframework/abp · error · AbpAuthorizationException

Volo.Authorization:010005

Volo.Authorization:010005

Error message

Authorization failed! Given requirements has not granted for given resource: {ResourceName}

What it means

Thrown by CheckAsync(this IAuthorizationService, object resource, IEnumerable<IAuthorizationRequirement> requirements) when IsGrantedAsync(resource, requirements) is false. Error code Volo.Authorization:010005 (GivenRequirementsHasNotGrantedForGivenResource), ResourceName attached as data. This is the multi-requirement, resource-scoped variant.

Source

Thrown at framework/src/Volo.Abp.Authorization/Microsoft/AspNetCore/Authorization/AbpAuthorizationServiceExtensions.cs:178

    public static async Task CheckAsync(this IAuthorizationService authorizationService, AuthorizationPolicy policy)
    {
        if (!await authorizationService.IsGrantedAsync(policy))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGranted);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy against the specified resource, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="requirements">The requirements to evaluate the policy against.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, IEnumerable<IAuthorizationRequirement> requirements)
    {
        if (!await authorizationService.IsGrantedAsync(resource, requirements))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenRequirementsHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

    /// <summary>
    /// Checks if CurrentPrincipal meets a specific authorization policy against the specified resource, throwing an <see cref="AbpAuthorizationException"/> if not.
    /// </summary>
    /// <param name="authorizationService">The <see cref="IAuthorizationService"/> providing authorization.</param>
    /// <param name="resource">The resource to evaluate the policy against.</param>
    /// <param name="policyName">The name of the policy to evaluate.</param>
    public static async Task CheckAsync(this IAuthorizationService authorizationService, object resource, string policyName)
    {
        if (!await authorizationService.IsGrantedAsync(resource, policyName))
        {
            throw new AbpAuthorizationException(code: AbpAuthorizationErrorCodes.GivenPolicyHasNotGrantedForGivenResource)
                .WithData("ResourceName", resource);
        }
    }

View on GitHub (pinned to 7ed43b1931)

Solutions

Identify which requirement in the enumerable is not being Succeeded (test each individually).
Confirm a resource-aware handler is registered for every requirement type passed.
Ensure the resource instance is the correct type and passes each handler's logic.
Reduce the requirement set to the minimum needed so unrelated failures don't block access.

Example fix

// before
await AuthorizationService.CheckAsync(doc, new[] { OwnsReq, IsActiveReq }); // 010005
// after: verify each requirement passes; here doc was inactive -> activate or allow

Defensive patterns

Strategy: validation

Validate before calling

if (!await authorizationService.IsGrantedAsync(resource, requirements))
{
    // return 403 for this resource/requirements set
}

Type guard

null

Try / catch

try { await authorizationService.CheckAsync(resource, requirements); }
catch (AbpAuthorizationException ex) when (ex.Code == "Volo.Authorization:010005")
{ /* handle forbidden; check each requirement individually */ }

Prevention

Register resource-aware handlers for every requirement type you pass.
Test each requirement separately to find which one denies.
Keep the requirement set minimal to avoid unrelated denials.
Ensure the resource instance type matches each handler.

When it happens

Trigger: Calling authorizationService.CheckAsync(resource, new[] { req1, req2 }) where at least one requirement, evaluated against the resource, does not succeed for the current principal.

Common situations: One of several requirements fails for the resource (e.g. ownership ok but status check fails); a requirement in the list has no matching handler; resource is null/wrong-typed for some handler; mixing requirement types with incompatible handlers.

Related errors

AI-assisted analysis of abpframework/abp@7ed43b1931 (2026-08-13). Data as JSON: /api/errors/8a91331dd1745392. Report an issue: GitHub.