Getting Authorization Right in .NET: Patterns, Pitfalls...

on YouTube ↗01h 07m

" summary

Concrete .NET code demos show policy creation, custom IAuthorizationRequirement handlers with DI, and minimal APIs and authorization handlers wired into routes; a live Policy Server demo and JSON-backed external policy handler illustrate centralizing decisions (no token bloat), with examples of role explosion (hundreds of roles), caching/invalidation concerns, and step‑up auth via a recent‑login policy. Razor UI uses a tag helper that hides buttons by querying the policy, and feature‑area routing demonstrates per‑route permission evaluation—practical if you want implementation patterns not theory.

AI-written summary · about

" chapters (12)

1. 0:00Authorization challenges in .NET
2. 5:28AuthN vs AuthZ separation
3. 9:44Default ASP.NET Core policies
4. 12:51Demo: Razor Pages security
5. 19:12Demo: API security with minimal APIs
6. 23:45Reusable authorization policies
7. 31:17AuthZ requirements with DI
8. 34:45Externalizing authZ policies
9. 41:50Demo: JSON policy evaluation
10. 45:24UI authZ and step-up authN
11. 56:34Demo: UI feature authZ with tag helpers
12. 1:03:21Enterprise-scale authZ design

" related talks

• 58mImplementing Authorization in Web Applications and APIsDominick Baier, Brock Allen · NDC London 2018
• 58mImplementing authorization in web applications and APIsBrock Allen · NDC Minnesota 2018
• 01h 02mImplementing authorization in web applications and APIsDominick Baier · NDC Sydney 2017
• 54mAuthorization for modern ApplicationsDominick Baier · NDC Oslo 2018
• 56mImplementing authorization in web applications and APIsDominick Baier, Brock Allen · NDC Oslo 2017
• 36mFlexible Authorisation with ASP.NET Core 7.0Jason Taylor · NDC Oslo 2023
• 51mAuthentication and Authorization in ASP.NET Core 2Roland Guijt · Update Conference Prague 2018
• 47mDeveloping Flexible Authorisation Capabilities in ASP.NET CoreJason Taylor · NDC London 2023