c# - Should i do authorization on my Domain Services? -

i have following domain service:

pulic void deletecustomer(int customerid, string useridentity, string userpassword) {     //1º login operation verify if credentials valid.      customerrepository.deletebyid(customerid); } 

let's consuming code of asp.net mvc or windows forms application has login window.

the login validated again in each operation, wasting resources.

let's change to:

pulic void deletecustomer (int customerid, int requestuserid) {     //1º trust requestuserid valid.      //do requestuserid (e.g set userid deleted customer)      customerrepository.deletebyid(customerid); } 

in case, login operation made asp.net mvc or windows forms application 1 time caller can pass requestuserid, leaving terrible security hole.

it makes sense authorization in methods need authorization otherwise there security problem, when these methods entry points in backend logic. means if deploy these domain services tier accessible outside, these methods really need protection.

from defensive programming perspective, every method should able defend invalid or fake inputs applicable in case.

from rest stateless perspective, every request should isolated each other means each request should carry necessary information without relying on previous requests , there should not server state. reason, requests should authorized independently.

furthermore, authorization cross-cutting concern, should consider writing authorization code attribute.