Fixing missing access control

An access control vulnerability can allow a malicious actor to access your ASP.NET Core web application just by simply registering an account and getting authenticated. This security flaw can lead to unauthorized access to sensitive information.

In this recipe, we add roles to the sample Online Banking app to integrate a policy-based authorization.

Getting ready

We will use the Online Banking app we used in the previous recipe. Using VS Code, open the sample Online Banking app folder at \Chapter06\missing-access-control\before\OnlineBankingApp\.

You can also perform the steps in this folder for the Fixing missing access control recipe.

How to do it…

Let's take a look at the steps for this recipe.

1. From the starting exercise folder, launch VS Code by typing the following command:

   code .

2. Open the \Pages\FundTransfers\Create.cshtml.cs file and notice the Authorize annotation on top of the CreateModel class:

   namespace...