Understanding authorization
Authorization in ASP.NET Core is handled by a middleware. When your application receives the first request from an unauthenticated user to a secured resource, an authentication challenge is invoked by the middleware, and depending on the authentication scheme, the user is either redirected to log in or access is forbidden. Once the identity of the user has been established after authentication, the authorization middleware checks whether the user can access the resource or not. In subsequent requests, the authorization middleware uses the identity of the user to determine whether access is allowed or forbidden.
To configure authorization middleware in your project, you need to invoke UseAuthorization() inside the Configure method of Startup.cs. It is mandatory to register authorization middleware only after authenticating middleware since authorization can be performed only after establishing the user's identity. Refer to the following code:
app...
