UseAuthorization

As explained in ASP.NET Core in Action, 3e

UseAuthorization is an ASP.NET Core extension method that adds authorization middleware to a web application's request pipeline.

UseAuthorization() adds authorization middleware to an ASP.NET Core request pipeline. It checks the selected endpoint’s authorization requirements and uses HttpContext.User to decide whether the request may continue. section 24.2

Place the middleware in the pipeline in this order:

• Call UseRouting() first so the selected endpoint and its authorization metadata are available. section 24.2
• Call UseAuthentication() before UseAuthorization() so the current user is available. section 24.2
• Call UseAuthorization() before UseEndpoints() so authorization runs before the endpoint executes. section 24.2
• Remember that WebApplication normally adds this middleware in the correct order; verify the order when customizing the pipeline. section 24.2

Protected endpoint flow

A request reaches UseAuthorization() after routing and authentication. If the endpoint has requirements, the middleware checks the authenticated user. An authorized request continues; an unauthorized request stops before the endpoint middleware runs. section 24.2

Figure 24.2 Authorization occurs after an endpoint has been selected and after the request is authenticated, but before the action method or Razor Page endpoint is executed.

Use the pipeline diagram to visualize authorization after endpoint selection and authentication, but before the action method or Razor Page endpoint executes. section 24.2

How ASP.NET Core in Action, 3e covers it

How deep it goes

Explains middleware behavior and ordering, but defers detailed policy and custom requirement implementation.

Examples

Uses protected Razor Pages and MVC actions as endpoint examples, including authenticated and unauthorized request outcomes.

What it assumes

Assumes routing and authentication middleware, while distinguishing authentication from authorization.

What you can do after

Operate/configure an ASP.NET Core pipeline so authorization runs between authentication and endpoint execution.

How it connects

Connects routing, authentication, authorization middleware, endpoint metadata, HttpContext.User, and authorization policies.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Related concepts

• AuthorizationMiddlewareconfigures · Authorization middleware is request-processing software that evaluates whether a requester is permitted to access a protected endpoint or resource.
• request pipelineconfigures · A request pipeline is an ordered sequence of processing components through which HTTP requests and their responses pass in a web application.
• middlewareconfigures · Middleware is an intermediate software component or layer that processes or mediates requests, messages, or operations between other components, often adding behavior or controlling their flow.
• RequireAuthorizationuses · RequireAuthorization is an ASP.NET Core endpoint-mapping method that configures an endpoint to require authorization.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.