Introduction to authorization in ASP.NET Core

Članak
02.12.2024.

Authorization refers to the process that determines what a user is able to do. For example, an administrative user is allowed to create a document library, add documents, edit documents, and delete them. A non-administrative user working with the library is only authorized to read the documents.

Authorization is separate and distinct from authentication. However, authorization relies on an authentication mechanism. Authentication is the process of verifying a user's identity, which may result in the creation of one or more identity objects for the user.

For more information about authentication in ASP.NET Core, see Overview of ASP.NET Core Authentication.

Authorization types

ASP.NET Core authorization provides a simple, declarative role and a rich policy-based model. Authorization is expressed in requirements, and handlers evaluate a user's claims against requirements. Imperative checks can be based on simple policies or policies which evaluate both the user identity and properties of the resource that the user is attempting to access.

Namespaces

Authorization components, including the AuthorizeAttribute and AllowAnonymousAttribute attributes, are found in the Microsoft.AspNetCore.Authorization namespace.

Consult the documentation on simple authorization.

Sarađujte sa nama na GitHub-u

Izvor za ovaj sadržaj možete da pronađete u usluzi GitHub, gde možete i da kreirate i pregledate probleme i povučete zahteve. Više informacija potražite u našem vodiču za saradnike.

Povratne informacije za ASP.NET Core

ASP.NET Core je projekat otvorenog koda. Izaberite vezu da biste pružili povratne informacije:

Otvorite problem sa dokumentacijom Pošaljite povratne informacije o proizvodu

Dodatni resursi

Dokumentacija

Create an ASP.NET Core app with user data protected by authorization

Learn how to create an ASP.NET Core web app with user data protected by authorization. Includes HTTPS, authentication, security, ASP.NET Core Identity.
Role-based authorization in ASP.NET Core

Learn how to restrict ASP.NET Core controller and action access by passing roles to the Authorize attribute.
Custom authorization policies with IAuthorizationRequirementData

Learn how to add custom authorization policies with IAuthorizationRequirementData.
Razor Pages authorization conventions in ASP.NET Core

Learn how to control access to pages with conventions that authorize users and allow anonymous users to access pages or folders of pages.
Authorize with a specific scheme in ASP.NET Core

This article explains how to limit identity to a specific scheme when working with multiple authentication methods.