Authorization determines whether an authenticated client has permission to access a requested resource. It answers a different question from authentication: proving who the client is does not, by itself, grant access. An admin-only page is one example of a resource that needs a permission check. section 8.1 section 8.6
In an online shop, anyone can browse the product catalog, but placing an order requires a registered, logged-in user. A shared identity provider supports single sign-on; OpenID Connect handles authentication, while OAuth provides the authorization mechanism. The UI can pass credentials and permission information to a backend API in a JWT. section 8.1 section 8.6 section 1.1
For an ASP.NET Core UI, put the access check into the request pipeline:
- Configure authentication with cookies and OpenID Connect so the UI can establish the user's identity. section 8.3
- Register authorization with AddAuthorization(), then call UseAuthentication() and UseAuthorization() in that order. section 8.3
- Mark a UI page that requires a signed-in user with [Authorize]. Leave catalog browsing available without that restriction. section 8.3 section 8.1
Catalog versus checkout
A shopper can inspect products without logging in. Attempting to place an order instead requires registration and login; after registration, the shopper returns to the web frontend with access to its protected functionality. section 8.1
