Register a named policy in Program.cs, then apply it to the MVC action, Razor Page, or endpoint that needs protection. Use built-in claim or role requirements for straightforward checks; use a custom requirement and handler when authorization depends on calculations, domain data, or a specific resource.
What a policy does
An authorization policy is a named set of one or more requirements evaluated against a user and, when relevant, a resource. Each requirement in a policy must succeed for that policy to succeed. For example, a policy can require that a user has a particular claim, belongs to a role, or meets a custom rule.
A policy is not a replacement for configuring authentication. Your app still needs to establish the current user through its authentication setup. Add RequireAuthenticatedUser() to a policy when it must explicitly require a signed-in user as well as the other conditions.
Register a policy in Program.cs
For a claim-presence check, register a policy with AddAuthorizationBuilder() and AddPolicy():
#1 Best Overall
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthorizationBuilder()
.AddPolicy("EmployeeOnly", policy =>
policy.RequireClaim("EmployeeNumber"));This policy succeeds when the user has an EmployeeNumber claim. To require a particular claim value, pass the accepted value as an additional argument to RequireClaim:
policy.RequireClaim("Department", "Finance");If your app uses the options-based registration style, you can add a policy through AddAuthorization instead:
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("AtLeast21", policy =>
policy.Requirements.Add(new MinimumAgeRequirement(21)));
});Use one registration style that fits the project; both configure authorization services. These examples reflect current ASP.NET Core 10 documentation, and APIs or project setup can differ in older target frameworks.
Apply the policy to the part of the app it protects
MVC controller or action
Add the Authorize attribute to a controller to protect its actions, or to an individual action for narrower coverage:
[Authorize(Policy = "EmployeeOnly")]
public IActionResult Reports() => View();When authorization attributes apply at both controller and action levels, all of the applied policies must pass.
Minimal API endpoint
For a route handler, chain RequireAuthorization to the mapped endpoint:
app.MapGet("/reports", () => Results.Ok())
.RequireAuthorization("EmployeeOnly");Policies can also be applied to Razor Pages, Razor components, and other endpoint-routing surfaces. Use the authorization mechanism appropriate to the part of the app being protected.
Choose a built-in requirement or a custom rule
| Approach | Use it when | How it fits a policy |
|---|---|---|
| Claim | The rule checks whether a claim exists or has an accepted value. | Use RequireClaim. |
| Role | The identity system issues stable roles and access depends on role membership. | Use RequireRole. |
| Custom requirement and handler | The rule needs calculations, domain data, or resource context. | Represent the rule with IAuthorizationRequirement and evaluate it in a handler. |
| Assertion | A small inline predicate is clearer than separate requirement and handler classes. | Use RequireAssertion in the policy configuration. |
For example, a role-based policy can be registered alongside a claim policy:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →builder.Services.AddAuthorizationBuilder()
.AddPolicy("ManagersOnly", policy =>
policy.RequireRole("Manager"));Role checks depend on the roles present in the authenticated identity. Use a claim requirement instead when the actual rule is about a claim and its value, rather than role membership.
Create a custom requirement and handler
Use a custom requirement when a built-in claim or role check does not express the rule. The requirement carries the policy data; an authorization handler evaluates that data for the current user.
public sealed class MinimumAgeRequirement : IAuthorizationRequirement
{
public MinimumAgeRequirement(int minimumAge) => MinimumAge = minimumAge;
public int MinimumAge { get; }
}
public sealed class MinimumAgeHandler
: AuthorizationHandler<MinimumAgeRequirement>
{
protected override Task HandleRequirementAsync(
AuthorizationHandlerContext context,
MinimumAgeRequirement requirement)
{
var dateOfBirth = context.User.FindFirst(
ClaimTypes.DateOfBirth)?.Value;
if (dateOfBirth is not null &&
DateTime.TryParse(dateOfBirth, out var dob) &&
dob <= DateTime.Today.AddYears(-requirement.MinimumAge))
{
context.Succeed(requirement);
}
return Task.CompletedTask;
}
}The example reads a date-of-birth claim, parses it, and succeeds the requirement when the date meets the threshold. In a production rule, ensure the claim format and age calculation match your domain and date-handling requirements.
Register the handler with dependency injection and register a policy that uses the requirement:
Recommended Free Tools
Best Value
builder.Services.AddSingleton<IAuthorizationHandler, MinimumAgeHandler>();
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("AtLeast21", policy =>
policy.Requirements.Add(new MinimumAgeRequirement(21)));
});A handler signals success with context.Succeed(requirement). If a failed check must make the overall authorization fail even when another handler could satisfy the requirement, call context.Fail(); otherwise, leaving the requirement unsatisfied is enough for the policy not to succeed.
Use imperative and resource-based authorization
Attributes and endpoint conventions work when the policy is known in advance and does not need an individual resource instance. For a check that depends on a particular document or other resource, call IAuthorizationService.AuthorizeAsync in the application flow:
var result = await authorizationService.AuthorizeAsync(
User, document, "CanEditDocument");
if (!result.Succeeded)
return Forbid();Here the current user, the document resource, and the named policy are evaluated together. IAuthorizationService also supports checks using requirements directly, as well as policy-name checks without a resource. This is useful when the code must load an object first and then decide whether the current user may act on that object.
Quick Recap
Common implementation checks
- Make the policy name used in the attribute or endpoint match the name registered during service configuration.
- Put each required condition in the policy. Multiple requirements combine with AND semantics: every one must pass.
- Use a claim or role requirement for simple identity checks; use a handler when the rule needs application logic or a resource.
- Register custom authorization handlers in dependency injection so authorization can resolve them.
- Confirm that the app’s authentication and authorization services and middleware are configured for its target framework and hosting model. The exact setup can vary by project, so do not assume that the policy-registration snippet alone is a complete application pipeline.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
