[davidfowl]

Avoid enumerator allocations when evaluating authorization handlers

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Avoid OfType iterators and boxed enumerators in authorization handlers.

Description

• New internal RequirementsOfType<T> struct enumerable. AuthorizationPolicy.Requirements is List<T>.AsReadOnly(), so the requirements a handler sees are usually a ReadOnlyCollection<IAuthorizationRequirement>; in that case it indexes directly and allocates nothing. Any other enumerable falls back to OfType<T>() unchanged. The type's doc comment explains the fast path, the fallback and why T is unconstrained.
• AuthorizationHandler<T>, AuthorizationHandler<T, TResource> and PassThroughAuthorizationHandler use it in place of context.Requirements.OfType<T>(), keeping their original foreach shape.
• DefaultAuthorizationService is unchanged from main (the earlier handler-array loop was reverted per review).
• Adds AuthorizationServiceBenchmark to src/Security/perf/Microbenchmarks.

No public API or behavior change. Tests: Microsoft.AspNetCore.Authorization.Test 213/213 on net12.0. RequirementsOfTypeTests compares the enumerable against OfType<T>() over ReadOnlyCollection, List, array and lazy-enumerable inputs; DefaultAuthorizationServiceTests runs typed, resource and pass-through handlers over the same collection kinds. net462, netstandard2.0 and net12.0 build with no warnings.

Benchmark

AuthorizationServiceBenchmark (added in this PR), measured on the latest head (e4166f6). In-process BenchmarkDotNet (--config perflab, [MemoryDiagnoser], Server GC) on .NET 12.0.0 (12.0.26.55606) X64 RyuJIT, SDK 12.0.100-alpha.1.26531.102, 2-core Linux VM. "main" is this PR's merge base (7816523) with identical benchmark source. 3 rounds, alternating main and PR.

Method	main Mean (r1 / r2 / r3)	PR Mean (r1 / r2 / r3)	Δ time (avg)	main Alloc	PR Alloc
AuthorizeAsync_DefaultPolicy	196.2 / 192.2 / 200.0 ns	152.9 / 145.2 / 145.5 ns	196.1 → 147.9 ns (−25%)	632 B	456 B
AuthorizeAsync_ClaimsAndRolePolicy	363.8 / 369.2 / 366.4 ns	258.3 / 253.0 / 261.6 ns	366.5 → 257.6 ns (−30%)	792 B	528 B
Invoke_HasEndpoint_Authorize	472.6 / 476.7 / 478.6 ns	412.2 / 405.1 / 399.6 ns	476.0 → 405.6 ns (−15%)	1,032 B	856 B

The ranges don't overlap in any row, and allocations were identical in every round. The savings (176 B and 264 B) are 2× and 3× 88 B, consistent with one OfType iterator plus boxed enumerator removed per handler call.

🤖 Posted by ASP.NET Core Perf 2 (AI Agent)

[Copilot]

🟢 Approval recommended

No active review issues are reported for the authorization iteration optimizations.

No open issues 🎉

What changed in this PR

This PR reduces iterator and enumerator allocations during authorization evaluation by adding fast paths for policy requirement collections and dependency-injected handler arrays, while preserving fallback enumeration.

Changes:

• Optimize typed and pass-through requirement handling, plus service-level handler iteration.
• Add tests for four requirement collection shapes, resource matching, and stopping after failure.
• Add authorization service and middleware benchmarks.

File	Description
src/​Security/​perf/​Microbenchmarks/​Microsoft.AspNetCore.Security.Microbenchmarks.csproj	Adds the routing reference needed by the benchmarks.
src/​Security/​perf/​Microbenchmarks/​AuthorizationServiceBenchmark.cs	Adds service and middleware authorization benchmarks.
src/​Security/​Authorization/​test/​DefaultAuthorizationServiceTests.cs	Tests collection variants, typed handlers, and failure short-circuiting.
src/​Security/​Authorization/​Core/​src/​PassThroughAuthorizationHandler.cs	Adds indexed iteration for read-only requirement collections.
src/​Security/​Authorization/​Core/​src/​DefaultAuthorizationService.cs	Iterates handler arrays directly to avoid enumerator allocation.
src/​Security/​Authorization/​Core/​src/​AuthorizationHandler.cs	Adds indexed requirement iteration to both generic handler variants.

_{Review effort: Balanced}

[PureWeen]

/review

[DeagleGross]

restrict T to be of IAuthorizationRequirement?

[davidfowl]

I tried where T : IAuthorizationRequirement and it doesn't compile. PassThroughAuthorizationHandler uses the same helper to find requirements that are also handlers:

foreach (var handler in new RequirementsOfType<IAuthorizationHandler>(context.Requirements))

IAuthorizationHandler doesn't derive from IAuthorizationRequirement, so every target fails with CS0311 ("no implicit reference conversion from 'IAuthorizationHandler' to 'IAuthorizationRequirement'"). That call site is a straight replacement for the original context.Requirements.OfType<IAuthorizationHandler>(), so I left T unconstrained and made no code change for this thread. If you'd prefer, I can constrain T to class, or drop the helper from PassThroughAuthorizationHandler and go back to OfType there so the constraint fits. The new tests in b86659d cover the IAuthorizationHandler filter case explicitly.

🤖 Posted by ASP.NET Core Perf 2 (AI Agent)

[DeagleGross]

recalculate the perf benefit again please and update pr description to know the benefit based on the latest code changes

[davidfowl]

Re-measured on the latest head (e4166f6, with DefaultAuthorizationService reverted) against the merge base, 3 interleaved local BenchmarkDotNet rounds on .NET 12. The win holds and the round ranges don't overlap:

Method	main	PR	Alloc
AuthorizeAsync_DefaultPolicy	196.1 ns	147.9 ns (−25%)	632 → 456 B
AuthorizeAsync_ClaimsAndRolePolicy	366.5 ns	257.6 ns (−30%)	792 → 528 B
Invoke_HasEndpoint_Authorize	476.0 ns	405.6 ns (−15%)	1,032 → 856 B

Means are averaged over the 3 rounds. Per-round numbers and setup are in the updated PR description. This branch also merges current main, which resolves the conflict.

🤖 Posted by ASP.NET Core Perf 2 (AI Agent)

[github-actions]

✅ No documentation PR was created.

Confidence that documentation is needed: 3%

No docs needed: internal performance refactoring of authorization handler requirement enumeration with tests and a benchmark; no public or observable behavior change.

Documentation surfaces considered

• Conceptual article: Not required — Internal struct is not public API (flagged signal is internal); allocation optimization only.
• Migration guidance: Not required — No user action needed on upgrade.
• Breaking change: Not required — No compatibility impact; PR states no public API or behavior change.