C# Academy · Lesson

Role-Based Authorization

Restrict endpoints by user roles.

Role-Based Authorization is a free C# Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the C# Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Authentication Versus Authorization

Authentication answers "who are you?". Authorization answers "what are you allowed to do?".

The simplest authorization model in ASP.NET Core is role-based: a user belongs to roles, and endpoints require specific roles.

// User has roles: admin, editor
// Endpoint requires: admin

Where Roles Come From

A role is just a claim of type ClaimTypes.Role. When you issue a JWT, add one role claim per role the user holds.

var claims = new List<Claim>
{
    new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
    new Claim(ClaimTypes.Role, "admin"),
    new Claim(ClaimTypes.Role, "editor")
};

The Role Claim Type

For [Authorize(Roles=...)] and User.IsInRole to work, the handler must know which claim type represents a role.

The JWT key role maps to ClaimTypes.Role by default. If you use a custom key, tell the validator via RoleClaimType.

options.TokenValidationParameters = new TokenValidationParameters
{
    RoleClaimType = ClaimTypes.Role
};

Requiring a Single Role

Apply [Authorize(Roles = "admin")] to a controller or action. Only users with the admin role may enter.

[Authorize(Roles = "admin")]
[HttpDelete("users/{id}")]
public IActionResult DeleteUser(int id)
{
    // only admins reach here
    return NoContent();
}

Requiring Any of Several Roles

A comma-separated list means OR: the user needs at least one of the listed roles.

[Authorize(Roles = "admin,editor")]
[HttpPut("articles/{id}")]
public IActionResult Update(int id) => Ok();
// admins OR editors are allowed

Requiring Multiple Roles (AND)

To require all of several roles, stack multiple [Authorize] attributes. Each one must pass.

[Authorize(Roles = "employee")]
[Authorize(Roles = "manager")]
public IActionResult ApproveBudget() => Ok();
// must be BOTH employee AND manager

Checking Roles in Code

Sometimes you need a role check inside the method body, not just at the door. Use User.IsInRole.

public IActionResult GetReport()
{
    var data = BuildReport();
    if (User.IsInRole("admin"))
        data.IncludeSensitiveColumns();
    return Ok(data);
}

Minimal API Equivalent

Minimal APIs use .RequireAuthorization with an inline policy or, more simply, you can require a role through a named policy.

app.MapDelete("/users/{id}", (int id) => Results.NoContent())
   .RequireAuthorization(p => p.RequireRole("admin"));

Roles in a Hierarchy

ASP.NET Core has no built-in role hierarchy. If admins should implicitly have editor rights, either grant both role claims at login or model it with policies (next course).

// Grant both at login if admin >= editor
new Claim(ClaimTypes.Role, "admin");
new Claim(ClaimTypes.Role, "editor");

When Roles Fall Short

Roles are coarse-grained. When rules depend on data (e.g. "only the owner can edit") or fine-grained permissions, role checks become messy.

That is where claims-based and policy-based authorization come in.

// Hard to express with roles alone:
// "editors, but only for their own department"

Returning 403 vs 401

If the user is not authenticated, a role check yields 401 Unauthorized. If they are authenticated but lack the role, they get 403 Forbidden.

// No/invalid token         -> 401 Unauthorized
// Valid token, wrong role   -> 403 Forbidden

Quick Check

Test your role knowledge.

Recap

You learned role-based authorization:

Roles are ClaimTypes.Role claims placed in the token.
[Authorize(Roles = "a,b")] means OR; stacking attributes means AND.
User.IsInRole checks roles in code.
Roles are coarse - data-driven rules need richer models.

Next: claims-based authorization.

Frequently asked questions

Is the “Role-Based Authorization” lesson free?

Yes — the full text of “Role-Based Authorization” is free to read here on the web, and the C# Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the C# Academy course, upgrade to CoddyKit PRO.

What will I learn in “Role-Based Authorization”?

Restrict endpoints by user roles. You practise C# Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start C# Academy?

No prior experience is required. C# Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Role-Based Authorization” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this C# Academy lesson?

Yes. Every C# Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to C# Academy