C# Academy · Lesson

Policy-Based Authorization

Define reusable authorization policies.

Policy-Based Authorization is a free C# Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the C# Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The Policy Model

In ASP.NET Core, every authorization check ultimately runs through a policy. Roles and claims attributes are shorthand that build policies behind the scenes.

Defining named policies centralizes your rules and keeps controllers clean.

[Authorize(Policy = "CanManageOrders")]

AddAuthorization

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanManageOrders", policy =>
        policy.RequireRole("admin", "sales"));
});

RequireAuthenticatedUser

The most basic requirement is simply that the user is signed in. RequireAuthenticatedUser rejects anonymous callers.

options.AddPolicy("SignedIn", policy =>
    policy.RequireAuthenticatedUser());

Composing Requirements

A policy builder chains multiple requirements; the policy succeeds only if all of them pass.

options.AddPolicy("SeniorEditor", policy =>
    policy
        .RequireAuthenticatedUser()
        .RequireRole("editor")
        .RequireClaim("seniority", "senior"));

The Default Policy

A bare [Authorize] with no arguments uses the default policy, which out of the box just requires an authenticated user. You can replace it.

options.DefaultPolicy = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .RequireClaim("email_verified", "true")
    .Build();

The Fallback Policy

The fallback policy applies to endpoints that have no authorization attribute at all - a powerful way to secure-by-default.

options.FallbackPolicy = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .Build();
// Now every endpoint requires auth unless marked [AllowAnonymous]

Opting Out With AllowAnonymous

When a fallback policy locks everything down, use [AllowAnonymous] to expose public endpoints like login or health checks.

[AllowAnonymous]
[HttpGet("health")]
public IActionResult Health() => Ok("healthy");

Applying Policies to Endpoints

Reference a policy by name in attributes or minimal API extensions.

// Controller
[Authorize(Policy = "SeniorEditor")]
public IActionResult Publish() => Ok();

// Minimal API
app.MapPost("/publish", () => Results.Ok())
   .RequireAuthorization("SeniorEditor");

Grouping Endpoints

Apply a policy to a whole route group so every endpoint inside inherits it.

var admin = app.MapGroup("/admin")
               .RequireAuthorization("CanManageOrders");

admin.MapGet("/stats", () => Results.Ok());
admin.MapDelete("/{id}", (int id) => Results.NoContent());

Requirements Under the Hood

Each Require* call adds an IAuthorizationRequirement to the policy. A matching handler evaluates each requirement. For built-ins this is automatic; custom rules need a custom handler (next lesson).

// RequireRole("admin") adds a RolesAuthorizationRequirement
// RequireClaim(...) adds a ClaimsAuthorizationRequirement

Where to Define Policies

Keep all policy definitions in one extension method so they are discoverable and testable.

public static IServiceCollection AddAppPolicies(
    this IServiceCollection services)
{
    services.AddAuthorization(o =>
    {
        o.AddPolicy("SignedIn", p => p.RequireAuthenticatedUser());
        o.AddPolicy("CanManageOrders", p => p.RequireRole("admin"));
    });
    return services;
}

Quick Check

Test your understanding of default vs fallback policies.

Recap

You learned policy-based authorization:

AddPolicy defines named, reusable rules.
RequireAuthenticatedUser, RequireRole and RequireClaim compose with AND semantics.
DefaultPolicy backs bare [Authorize]; FallbackPolicy secures unmarked endpoints.
[AllowAnonymous] opts out.

Next: custom authorization requirements and handlers.

Frequently asked questions

Is the “Policy-Based Authorization” lesson free?

Yes — the full text of “Policy-Based Authorization” is free to read here on the web, and the C# Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the C# Academy course, upgrade to CoddyKit PRO.

What will I learn in “Policy-Based Authorization”?

Define reusable authorization policies. You practise C# Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start C# Academy?

No prior experience is required. C# Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Policy-Based Authorization” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this C# Academy lesson?

Yes. Every C# Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to C# Academy