Authorization

// Role-based
[Authorize(Roles = "Admin")]
public IActionResult DeleteUser(int id) { ... }

// Claims-based (via policy)
builder.Services.AddAuthorization(options => {
    options.AddPolicy("PremiumOnly", policy => policy.RequireClaim("subscription", "premium"));
});

Common follow-ups: How is a role technically implemented as just a special kind of claim internally?;When does claims-based authorization become preferable to role-based?

builder.Services.AddAuthorization(options => {
    options.AddPolicy("MinimumAge", policy =>
        policy.RequireAssertion(context =>
            context.User.HasClaim(c => c.Type == "age" && int.Parse(c.Value) >= 18)));
});

[Authorize(Policy = "MinimumAge")]
public IActionResult ViewRestrictedContent() { ... }

Common follow-ups: How do you write a fully custom IAuthorizationHandler for even more complex logic?;How do multiple requirements within one policy combine (AND vs OR)?

public class OwnerAuthorizationHandler : AuthorizationHandler<OwnerRequirement, Document> {
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, OwnerRequirement requirement, Document resource) {
        if (resource.OwnerId == context.User.FindFirst("sub")?.Value)
            context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

// Usage in an endpoint:
var document = await _repository.GetAsync(id);
var result = await _authorizationService.AuthorizeAsync(User, document, "DocumentOwner");
if (!result.Succeeded) return Forbid();

Common follow-ups: Why can't resource-based authorization be expressed with a declarative attribute alone?;How do multiple resource-based handlers for the same requirement combine?

// Unauthenticated request to a protected endpoint -> 401
// GET /api/admin/users (no Authorization header at all)

// Authenticated but insufficiently privileged request -> 403
// GET /api/admin/users
// Authorization: Bearer <valid token for a non-admin user>

Common follow-ups: Can you customize what triggers 401 versus 403 beyond the default authenticated/unauthenticated distinction?;How should a client's UI handle each status code differently?

public class BusinessHoursRequirement : IAuthorizationRequirement { }

public class BusinessHoursHandler : AuthorizationHandler<BusinessHoursRequirement> {
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, BusinessHoursRequirement requirement) {
        var now = DateTime.Now.TimeOfDay;
        if (now >= TimeSpan.FromHours(9) && now <= TimeSpan.FromHours(17))
            context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

builder.Services.AddAuthorization(o => o.AddPolicy("BusinessHoursOnly", p => p.Requirements.Add(new BusinessHoursRequirement())));

Common follow-ups: How would you inject additional dependencies (like a holiday calendar service) into the handler?;What happens if a policy has requirements that can never succeed due to a bug?

builder.Services.AddAuthorization(options => {
    options.FallbackPolicy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
});

[AllowAnonymous]  // must explicitly opt out for public endpoints
[HttpGet("health")]
public IActionResult Health() => Ok();

Common follow-ups: What endpoints commonly need [AllowAnonymous] even with this fallback policy enabled?;How does this interact with health check endpoints that orchestrators need to reach unauthenticated?

public class CustomAuthResultHandler : IAuthorizationMiddlewareResultHandler {
    private readonly AuthorizationMiddlewareResultHandler _default = new();
    public async Task HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult) {
        if (!authorizeResult.Succeeded) {
            context.Response.StatusCode = 403;
            await context.Response.WriteAsJsonAsync(new { title = "Access denied", policy = policy.AuthenticationSchemes });
            return;
        }
        await _default.HandleAsync(next, context, policy, authorizeResult);
    }
}

builder.Services.AddSingleton<IAuthorizationMiddlewareResultHandler, CustomAuthResultHandler>();

Common follow-ups: How does this interact with the global exception handling middleware for other error types?;What's the risk of leaking too much detail about why authorization failed?

app.MapGet("/admin/users", () => GetUsers())
   .RequireAuthorization("AdminOnly");

// Applying to an entire group at once
var adminGroup = app.MapGroup("/admin").RequireAuthorization("AdminOnly");
adminGroup.MapGet("/users", () => GetUsers());
adminGroup.MapDelete("/users/{id}", (int id) => DeleteUser(id));

Common follow-ups: How would you allow anonymous access to one endpoint within an otherwise-protected group?;Does RequireAuthorization support the same policy names as the [Authorize] attribute?

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, ResourceAccessRequirement requirement, Project resource) {
    if (context.User.IsInRole("SuperAdmin")) { context.Succeed(requirement); return Task.CompletedTask; }
    var userOrgId = context.User.FindFirst("org_id")?.Value;
    if (userOrgId == resource.OrganizationId.ToString() && context.User.IsInRole("OrgAdmin"))
        context.Succeed(requirement);
    return Task.CompletedTask;
}

Common follow-ups: How do you efficiently check organization membership without a database call on every single request?;How would you extend this model to support team-level (not just org-level) permissions?

[Authorize]
public class AccountController : ControllerBase {
    [AllowAnonymous]
    [HttpPost("login")]
    public IActionResult Login(LoginDto dto) { ... }  // publicly accessible despite controller-level [Authorize]

    [HttpGet("profile")]
    public IActionResult Profile() { ... }  // requires authentication (inherits controller-level attribute)
}

Common follow-ups: Does [AllowAnonymous] interact with a global FallbackPolicy the same way it does with controller-level [Authorize]?;What happens with multiple [Authorize] attributes stacked on the same action?