Authorization Fundamentals

What is Authorization?

Authorization determines what an authenticated user is allowed to do. It controls access to resources based on user identity, roles, claims, or policies.

Authorization Middleware

var app = builder.Build();

// Order matters!
app.UseAuthentication(); // First: Who are you?
app.UseAuthorization();  // Second: What can you do?

app.Run();

[Authorize] Attribute

The [Authorize] attribute restricts access to authenticated users only.

Controller Level

[Authorize]
public class DashboardController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}

Action Level

public class HomeController : Controller
{
    public IActionResult Index()
    {
        return View(); // Public
    }

    [Authorize]
    public IActionResult Profile()
    {
        return View(); // Requires authentication
    }
}

Razor Pages

[Authorize]
public class ProfileModel : PageModel
{
    public void OnGet() { }
}

[AllowAnonymous] Attribute

Allows anonymous access to specific actions even when controller is protected.

[Authorize]
public class AccountController : Controller
{
    [AllowAnonymous]
    public IActionResult Login()
    {
        return View(); // Public access
    }

    public IActionResult Profile()
    {
        return View(); // Requires authentication
    }
}

Global Authorization

Require authentication for all endpoints by default.

builder.Services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
});

Authorization in Views

@if (User.Identity?.IsAuthenticated == true)
{
    <a href="/dashboard">Dashboard</a>
}
@else
{
    <a href="/login">Login</a>
}

InvenTrack Example

[Authorize]
public class ProductsController : Controller
{
    // All actions require authentication
    
    public IActionResult Index()
    {
        var products = _context.Products.ToList();
        return View(products);
    }

    public IActionResult Create()
    {
        return View();
    }
}

Key Takeaways

• Authorization: Controls what users can do
• [Authorize]: Requires authentication
• [AllowAnonymous]: Allows public access
• UseAuthorization(): Must come after UseAuthentication()
• Global authorization: Require auth by default
• View checks: User.Identity?.IsAuthenticated