AuthorizationMiddleware

As explained in ASP.NET Core in Action, 3e

AuthorizationMiddleware is ASP.NET Core middleware that determines whether an authenticated user may access a selected endpoint.

AuthorizationMiddleware determines whether an authenticated user may access the endpoint selected for a request. It is most commonly used to enforce authorization for Razor Pages, MVC actions, and minimal API handlers. section 24.2

Routing selects the endpoint and exposes its authorization metadata, often supplied by an [Authorize] attribute. Authentication creates the request's ClaimsPrincipal and assigns it to HttpContext.User; AuthorizationMiddleware then evaluates access before the endpoint runs. section 24.2

Place the middleware in the request pipeline so each stage has the information it needs:

• Run routing first, so authorization requirements for the selected endpoint are available. section 24.2
• Run authentication before authorization, so the request has an authenticated user when authorization is evaluated. section 23.3.2 section 24.2
• Run authorization before endpoint middleware, the action method, or Razor Page executes. section 24.2

Typical pipeline

app.UseRouting(); app.UseAuthentication(); app.UseAuthorization(); app.MapRazorPages(); section 23.3.2

WebApplication can add authorization middleware automatically, but calling UseAuthorization explicitly controls its position. Incorrect ordering can cause authentication or policy application bugs. section 23.3.2

Figure 24.2 Authorization occurs after an endpoint has been selected and after the request is authenticated, but before the action method or Razor Page endpoint is executed.

Use the pipeline diagram to see authorization positioned after endpoint selection and authentication but before endpoint execution. section 24.2

How ASP.NET Core in Action, 3e covers it

How deep it goes

Explains endpoint metadata, ClaimsPrincipal creation, and pipeline ordering, but does not detail policy evaluation internals.

Examples

Uses an explicit UseRouting, UseAuthentication, UseAuthorization, and MapRazorPages pipeline.

What it assumes

Assumes routing and authentication middleware while establishing how selected endpoints, authenticated users, and authorization metadata interact.

What you can do after

Operate/configure the middleware pipeline and diagnose authorization failures caused by incorrect ordering.

How it connects

Connects routing middleware, authentication middleware, endpoint middleware, the Authorize attribute, and ClaimsPrincipal.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Related concepts

• challenge responseproduces · A challenge response is a response indicating that authentication is required before a protected resource can be accessed.
• dependency injectionuses · Dependency injection is a software design technique in which a component receives its dependencies from outside rather than creating or locating them internally.
• middlewarekind of · Middleware is an intermediate software component or layer that processes or mediates requests, messages, or operations between other components, often adding behavior or controlling their flow.
• UseAuthorizationconfigured by · UseAuthorization is an ASP.NET Core extension method that adds authorization middleware to an application's HTTP request pipeline.
• token validationuses · Token validation is the process of verifying a token’s format, authenticity, integrity, validity, and applicability to a request.
• forbid responseproduces · A forbid response indicates that an authenticated user lacks the authorization requirements needed to access an endpoint or execute an operation.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.