Delving deeper into authorization
Authorization is the process of determining whether a user is allowed to perform a specific action. In the previous section, we implemented a web API project that enables simple authentication and authorization. By using the Authorize attribute, only authenticated users can access the API. However, in many scenarios, we need to implement granular authorization. For example, some resources are only accessible to the administrator, while some resources are accessible to normal users. In this section, we will explore how to implement granular authorization in ASP.NET Core, including role-based authorization, claim-based authorization, and policy-based authorization.
Role-based authorization
You can find the starter app and the completed app in this book’s GitHub repository at chapter8/AuthorizationDemo/RoleBasedAuthorizationDemo. The starter app is similar to the application we created in the previous section:
- We’ll start with...
