Authorization

As authentication is all about knowing the identity of the user and validating its credentials, authorization can be implemented to know what the user is authorized to do after authentication. In ASP.NET Core applications, authorization can be implemented using declarative and imperative methods.

Declarative authorization techniques

ASP.NET Core provides a simple declarative role and policy-based model where authorization can be defined using different criteria and gets evaluated based on the user claims.

Declarative authorization can be defined using attributes. Attributes such as AuthorizeAttribute and AllowAnonymous can be annotated on controllers and actions and validated when they are accessed by the security framework.

Basic authorization

Here is the example of annotating attributes on EmployeeController:

    [Authorize]      
    [Route("api/[controller]")] 
    public class EmployeeController : Controller 
    { 
        [HttpGet] 
        public List<Employee> Get...