I have a .NET CORE API secured by JWT and Authorization enabled. The API is being consumed with a Blazor Client App. I am using services based on REFIT to call the API from the client. The Authorization is based on role and working well. However, I’d like to add an intermediate service which let me filter the API requests / routes based on logged-in user roles BEFORE calling the API.

In other words, I want to add a second security layer and prevent requesting the API when the routes are not allowed for such a role and short circuit the request before reaching the API. My inspiration was from the Laravel Framework Middleware concept used in routes/web.php where each route is declared and named in this file and the middleware, based on user role, is preventing the unauthorized user from reaching the API. I know that in .NET Core the Authorization is already well managed by the API but because there will be a lot of requests to it, I’d like to prevent calling the API unnecessarily if the route is not allowed for a specific role.

I tried to add a ActionFilter but the API is called first then the Filter which is not the behavior I want. I tried within a Middleware but got same result.

Is there any way to implement a global service (as an entry point for the API or in the Blazor Client App) that checks the logged user role and return an Unauthorized status code before even reaching the API? A kind of route-role based filter?

Thank you very much for your help.

Best regards