Here, we will see how we can control access to parts of the application, be it controllers or more fine-grained.
So, let's say you want to mark either a whole controller or specific actions as requiring authentication. The easiest way is to add an [Authorize] attribute to the controller class, just like that. If you try to access the protected controller or resource, a 401 authorization Required error will be returned.
In order to add authorization support, we must add the required middleware to the Configure method, after the UseAuthentication call, like this:
app.UseRouting();
app.UseCookiePolicy();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
//...
});
Do not forget about this order—UseAuthentication before UseAuthorization—this is mandatory!
The following sections describe different ways to declare authorization rules for resources on our web application. Let...
