By the end of this session, you will be able to:

• Implement role-based authorization using [Authorize(Roles="Admin")]
• Create custom policy-based authorization requirements in Program.cs
• Implement resource-based authorization so users can only access their own data
• Explain the difference between role-based and claim-based authorization

ASP.NET Core returns different HTTP status codes depending on why access was denied.

The role must be added as a claim when the JWT is issued (Session 19). ASP.NET Core reads ClaimTypes.Role from the token automatically.

var claims = new List<Claim>
{
    new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
    new Claim(ClaimTypes.Email, user.Email),
    new Claim(ClaimTypes.Role, user.Role)   // e.g. "Admin" or "Member"
};

[ApiController]
[Authorize(Roles = "Admin")]        // applies to all actions below
[Route("api/admin")]
public class AdminController : ControllerBase
{
    [HttpGet("users")]
    public IActionResult GetAllUsers() { ... }

    [HttpDelete("users/{id}")]
    public IActionResult DeleteUser(int id) { ... }

    // Override: allow any authenticated user to see stats
    [AllowAnonymous]
    [HttpGet("stats/public")]
    public IActionResult PublicStats() { ... }
}

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanManageTasks", policy =>
        policy.RequireAuthenticatedUser()
              .RequireRole("Admin", "Manager"));

    options.AddPolicy("PremiumUser", policy =>
        policy.RequireClaim("subscription", "premium"));

    options.AddPolicy("AtLeast18", policy =>
        policy.RequireAssertion(ctx =>
            ctx.User.HasClaim(c =>
                c.Type == "age" && int.Parse(c.Value) >= 18)));
});

When built-in helpers are not enough, implement IAuthorizationRequirement and a matching handler.

public class MinimumExperienceRequirement : IAuthorizationRequirement
{
    public int Years { get; }
    public MinimumExperienceRequirement(int years) => Years = years;
}

public class MinimumExperienceHandler
    : AuthorizationHandler<MinimumExperienceRequirement>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        MinimumExperienceRequirement requirement)
    {
        var claim = context.User.FindFirst("yearsOfExperience");
        if (claim != null && int.Parse(claim.Value) >= requirement.Years)
            context.Succeed(requirement);
        return Task.CompletedTask;
    }
}

• Role-based auth answers: "can Admins delete tasks?" — yes or no for a whole group
• Resource-based auth answers: "can Ahmed delete this specific task?" — depends on ownership
• Without it, any authenticated Member can delete another Member's tasks by guessing the ID
• The resource (the task record) must be loaded first, then the authorization check runs against it
• IAuthorizationService is injected into the controller and called imperatively

public class TaskAuthorizationHandler
    : AuthorizationHandler<OperationAuthorizationRequirement, TaskItem>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        OperationAuthorizationRequirement requirement,
        TaskItem resource)
    {
        var userId = context.User
            .FindFirst(ClaimTypes.NameIdentifier)?.Value;

        if (resource.UserId.ToString() == userId
            || context.User.IsInRole("Admin"))
        {
            context.Succeed(requirement);
        }

        return Task.CompletedTask;
    }
}

private readonly IAuthorizationService _authz;

public TasksController(IAuthorizationService authz) =>
    _authz = authz;

[Authorize]
[HttpDelete("{id}")]
public async Task<IActionResult> Delete(int id)
{
    var task = await _repo.GetByIdAsync(id);
    if (task is null) return NotFound();

    var result = await _authz.AuthorizeAsync(
        User, task, Operations.Delete);
    if (!result.Succeeded) return Forbid();

    await _repo.DeleteAsync(task);
    return NoContent();
}

Work through these steps on your Task Management API project:

Session 21 — API Security: Rate Limiting, CORS & HTTPS

• Configuring rate limiting to prevent abuse and denial-of-service
• Understanding CORS and setting up allowed origins for your frontend
• Enforcing HTTPS and configuring HSTS in production
• Security headers and what each one protects against

Extend your Task Management API with a complete authorization layer.

• Add [Authorize(Roles = "Admin")] to a dedicated admin endpoint (e.g., GET /api/admin/users)
• Define a "CanManageTasks" policy in Program.cs and apply it to DELETE and PUT task endpoints
• Implement TaskAuthorizationHandler so users can only edit or delete tasks they own; Admins bypass this check
• Return 403 Forbidden (not 404) when ownership check fails so the client knows the resource exists but is off-limits