An authorization policy is a named set of requirements for accessing an endpoint. Authentication establishes who made the request; the policy determines whether that user may proceed. In ASP.NET Core, authorization middleware checks the selected endpoint’s policy against the current user. section 24.3 section 25.6
Protect an airport security page
Register a policy named CanEnterSecurity with a BoardingPassNumber claim requirement, then put [Authorize("CanEnterSecurity")] on the Razor Page. A user with the claim can enter; an unauthenticated user is challenged; an authenticated user who fails the policy is forbidden. With cookie authentication, those last two outcomes typically redirect to login and access-denied pages. section 24.3 section 24.2.2
Listing 24.4 Adding an authorization policy using AuthorizationPolicyBuilder
WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthorizationBuilder() #1
.AddPolicy( #2
"CanEnterSecurity", #3
policyBuilder => policyBuilder #4
.RequireClaim("BoardingPassNumber")); #4
});
// Additional configuration
See how AddAuthorizationBuilder().AddPolicy() gives a name to a claim requirement in application setup. section 24.3
For straightforward rules, a policy builder can require an authenticated user, a claim, an allowed claim value, a username, or an assertion. Apply a named policy with [Authorize("PolicyName")] on a Razor Page or MVC action. On a minimal API endpoint, use RequireAuthorization("PolicyName"); the same policy concepts and services apply. section 24.3 section 25.6
For more involved rules, a policy contains one or more requirements, each handled by one or more authorization handlers. Every requirement must pass, but one successful handler can satisfy a requirement—an AND across requirements and an OR across its handlers. An explicit handler failure prevents authorization even when another handler succeeds. Multiple [Authorize] policies must all pass. section 24.4.1 section 24.7
Combine lounge-entry rules
A lounge policy can require a minimum age of 18 and permission to enter. Either a Gold frequent-flyer claim or an employee-number claim can establish permission; a ban can explicitly deny entry. Implement custom requirements with IAuthorizationRequirement, put checks in handlers, and register those handlers with dependency injection. section 24.4 section 24.4.2
When the decision depends on a particular resource, load it before checking the policy. For example, a recipe-editing page or deletion endpoint can pass the current user, loaded recipe, and CanManageRecipe policy to IAuthorizationService.AuthorizeAsync(). If authorization fails, forbid the operation rather than changing the recipe. section 24.5.1 section 25.6
