Use `[Authorize]` to require permission before an ASP.NET Core endpoint runs. In its simplest form, it allows authenticated users and blocks anonymous requests. Put it on an MVC action, controller, or Razor Page; you can also apply it globally. An action-level attribute protects just that action, while a controller-level attribute protects all its actions. section 22.1.1 section 24.2.1
Protect one action
In an API controller, leave `List()` available without the attribute and put `[Authorize]` above `View()`. An authenticated user can execute `View()`; an unauthenticated user cannot. The attribute expresses the requirement without putting a login check in the action body. section 24.2.1
The attribute adds authorization metadata to the endpoint selected by routing. Authentication establishes `HttpContext.User` from a cookie or API bearer token. Authorization middleware then checks the selected endpoint’s requirements before it executes. Configure authorization after routing and authentication, and before endpoint execution. section 24.2 section 24.7
If the user meets the requirements, the endpoint runs. Otherwise, authorization stops the request: an unauthenticated user receives a challenge; an authenticated user who lacks a required permission receives a forbid response. With cookie authentication, these can redirect to login or access-denied pages. The response depends on the authentication setup; an API may instead return an unauthorized response. section 24.2.2 section 22.1.1
For a finer-grained rule, name a policy: `[Authorize("CanEnterSecurity")]`. The policy defines requirements, such as a claim the user must have. Register that policy with the authorization services; naming it on the attribute alone does not define it. section 24.3
Keep a login action reachable
A controller protected with `[Authorize]` can mark its `Login()` action `[AllowAnonymous]`. This matters when a broad authorization rule would otherwise prevent an unauthenticated user from reaching the place where they log in. section 24.2.1
Minimal API handlers can use `[Authorize]` too. `RequireAuthorization()` provides the equivalent endpoint or route-group configuration, optionally with a policy name. For a decision that depends on a particular resource—for example, whether someone may delete a recipe they created—load the resource and call `IAuthorizationService.AuthorizeAsync` instead of relying only on the endpoint attribute. section 25.6
