An authorization decision answers a practical question: may this caller perform this action on this resource? Authentication establishes who the caller is; authorization determines what that caller may do. Permissions can allow or deny actions such as reading, updating, and deleting. Anonymous callers typically receive only the permissions needed to reach public content or a login endpoint. section 9.1.2 section 9.6
Consider a board-game API with update and delete endpoints. Leaving those endpoints open lets anyone alter its data. An initial restriction can require an authenticated caller, but that makes every signed-in user eligible. A more precise decision also checks the caller’s assigned role. section 9.0 section 9.3.3
To make the decisions more specific:
- Require the Moderator role on update methods in BoardGamesController, DomainsController, and MechanicsController. section 9.4.5
- Require the Administrator role on delete methods and SeedController. section 9.4.5
- Include each assigned role as a claim in the user’s JSON Web Token (JWT), then use `[Authorize(Roles = ...)]` to check the required role. section 9.4.5
app.MapGet("/auth/test/2",
[Authorize(Roles = RoleNames.Moderator)]
[EnableCors("AnyOrigin")]
[ResponseCache(NoStore = true)] () =>
{
return Results.Ok("You are authorized!");
});
app.MapGet("/auth/test/3",
[Authorize(Roles = RoleNames.Administrator)]
[EnableCors("AnyOrigin")]
[ResponseCache(NoStore = true)] () =>
{
return Results.Ok("You are authorized!");
});
These harmless Minimal API endpoints separate the Moderator and Administrator checks from operations that would permanently change data. section 9.4.6
Check the decision without changing data
Call a protected test endpoint in SwaggerUI before logging in: the expected response is 401 Unauthorized. Log in, supply the resulting JWT through SwaggerUI’s Authorize button, and try again before the token expires; the authenticated-only test returns 200 OK. For role-restricted tests, a user with no role cannot access either endpoint, a Moderator can access the Moderator endpoint, and an account with both roles can access both. These checks show why a valid login alone is not enough for every operation. section 9.3.3 section 9.4.6
Role-based access control is one option in ASP.NET Core Identity. Claim-based checks can examine other claims, while policy-based checks support more advanced requirements. Whichever rule you choose, protect bearer tokens from third-party access and make endpoint authorization requirements clear in API documentation. section 9.6 section 11.5
