Protecting web API

APIs Controller classes are the heart of web API applications performing the most essential work of fulfilling business requirements. We need to protect them from unauthorized access.

The web APIs (controllers) are protected using the Authorize attribute that is applied on controller. Until and unless the client calling is identified, the access to the controller action methods are not given.

The following code snippet shows that the Authorize attribute applied to BudgetCategoryController accesses this API endpoint and will result in an unauthorized response (HTTP 401 Status code):

    using Microsoft.AspNetCore.Authorization; 
 
    namespace PersonalBudget.Controllers 
    {  
      [Authorize] 
      [Route("api/[controller]")] 
      public class BudgetCategoryController : Controller 
      { 
        ... 
      } 
    } 

Trying to access this endpoint on the browser or Postman will result in an unauthorized access, as shown in the following screenshot:

Shows Unauthorized...