Authorization · Access control
.NET resource policies and permission test matrices
Go beyond Authorize attributes to ownership handlers and regression tests.
Understand the concept
An Authorize attribute describes endpoint-level requirements, but ownership and tenant rules may require loaded resource data. IAuthorizationService can evaluate an operation against that resource. Load within the permitted scope where possible; never emit private data before checking access.
A handler compares trusted principal data with stored resource attributes. Do not use a client-supplied ownerId as the authority. Failed authentication and failed permission have different Challenge and Forbid behaviour, subject to the selected scheme and concealment policy. This is a flow map, not a complete handler implementation.
Build a matrix covering anonymous requests, invalid credentials, wrong owners, correct owners, wrong tenants, revoked permissions and read-only access. Include listings and file paths. If decisions are cached, include all required context and define invalidation. Readable policies reduce insecure copying into new endpoints.
When building maintainable resource access control in a .NET API.
Assuming one successful Admin test proves all access control works.
One topic. Three levels of depth.
[Authorize]
// Load resource within the verified access scope.The attribute is a general gate; resource checks remain necessary.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
The detail endpoint is protected, but the listing returns every tenant. Are tests complete?
Show the solution and explanation
No: test list scoping and all alternate resource paths.No. Listing is part of resource authorisation.