An access control list (ACL) is a set of rules that matches principals—users, groups, computers, or software—with allowed or denied access types for a resource. Access types can include reading, writing, and deleting, while resources can include filesystem folders, databases, website areas, or web API endpoints. section 9.1.2
Authorization evaluates these rules after authentication identifies the caller. Anonymous users receive the lowest possible permissions, authenticated users are matched against their ACLs, and restricted operations are allowed or denied according to the resulting permissions. section 9.1.2
Protecting board-game API endpoints
A practical API policy can organize authenticated users into permission groups: basic users get read-only endpoints, moderators get read and update endpoints but not delete or database-seeding endpoints, and administrators can read, update, delete, and seed. In ASP.NET Core, roles provide the group structure; role information is placed in JWT claims so authorization middleware can apply the appropriate rules. section 9.4
Implement the policy by following these practical steps:
- Register representative moderator and administrator users. section 9.4
- Create Moderator and Administrator roles; basic users can retain the permissions already provided to anonymous users. section 9.4
- Assign users to roles and include those roles in JWT claims so ASP.NET Core can recognize them. section 9.4
Trace how authentication identifies a caller before authorization checks permissions and decides whether a resource is available. section 9.1.2
