Restricting endpoints to authorized users only
User authorization is based on claims that are present in the payload of a JWT. We can use any claims for authorization, including any custom ones. For example, we can use a standard role claim to restrict endpoints to only those clients that have specific roles defined inside this claim, or we can just create a custom claim based on the combination of various fields in the object that represents the user. For example, we may add a particular claim to the payload of the token if the user has a specific role and also belongs to a specific organization. Then, on the server side, we can configure an authorization policy based on this claim.
There are many ways you can apply authorization in gRPC on ASP.NET Core, so we won't be able to cover them all in this chapter. We will focus on the standard role-based authorization. However, the general principles demonstrated in the following examples will be applicable to different types of...
