Authorize attribute
The ASP.NET Core Authorize attribute declares that an endpoint or application component requires authentication or satisfaction of specified authorization requirements.
ASP.NET Core in Action, 3e
The ASP.NET Core Authorize attribute marks an endpoint, controller, action, or Razor Page as requiring an authenticated user or satisfying specified authorization requirements.
- How it is used
- Protects ASP.NET Core endpoints by attaching authentication or named-policy requirements before they execute.
- How deep it goes
- Explains placement, middleware behavior, failed-request responses, and named policies; treats resource-based decisions as a separate authorization step.
- Examples
- Uses protected API actions, an anonymous login exception, a claim-based Razor Page policy, and minimal API endpoints.
- What you can do after
- Apply it via ASP.NET Core to protect actions and pages, allow deliberate exceptions, and require named policies.
Read how ASP.NET Core in Action, 3e explains authorize attribute →
Building Web APIs with ASP.NET Core
AuthorizeAttribute is an ASP.NET Core attribute that declares authorization requirements for a controller, action, or endpoint handler.
- How it is used
- Restricts board-game API operations that change data while leaving selected read-only operations open.
- How deep it goes
- Works through attribute placement, authentication tests, role parameters, and a policy example; does not implement the mobile-phone policy end to end.
- Examples
- Uses protected board-game updates, a SwaggerUI GET test returning 401 then 200, and a Moderator-plus-mobile-phone policy.
- What you can do after
- Apply it via ASP.NET Core attributes to protect endpoints by authentication, role, or named policy, then verify bearer-token access in SwaggerUI.
Read how Building Web APIs with ASP.NET Core explains authorize attribute →
Pro ASP.NET Core 7, Tenth Edition
The ASP.NET Core Authorize attribute is an attribute that restricts access to controllers, actions, Razor Pages, or other endpoints based on authentication, roles, or authorization policies.
- How it is used
- Restricts ASP.NET Core controllers, Razor Pages, Blazor entry points, and web service endpoints during request authorization.
- How deep it goes
- Explains placement, authentication and role arguments, inheritance, exceptions, redirects, and HTTP outcomes without detailing policy internals.
- Examples
- Uses SportsStore administration pages, an AdminPageModel base class, a Blazor host page, and a DataController API.
- What you can do after
- Apply it via ASP.NET Core authorization to protect pages, controllers, Blazor applications, and APIs, then verify login, denial, and success paths.
Read how Pro ASP.NET Core 7, Tenth Edition explains authorize attribute →
Related concepts
- AllowAnonymouscontrasts with · AllowAnonymous is an ASP.NET Core attribute that permits unauthenticated access to an endpoint or handler otherwise subject to authorization requirements.
- endpointconfigures · An endpoint is a network-accessible address or interface through which a service exposes a resource or operation and handles requests and responses.
- authorization decisionconfigures · An authorization decision determines whether a principal is permitted to access a resource or perform an action under applicable permissions or policy.
- attributekind of · An attribute is a named property, value, or piece of information associated with an entity, object, or program element.
- authorizationused by · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.