C# Academy · Lesson

Role-Based Authorization

Restrict endpoints by user roles.

Lesson 1 of 413 steps

Role-Based Authorization is a free C# Academy lesson on CoddyKit. This is lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the C# Academy learning path, and your progress syncs across the web and the CoddyKit app. The C# Academy course includes 4 lessons in total.

Authentication Versus Authorization

Authentication answers "who are you?". Authorization answers "what are you allowed to do?".

The simplest authorization model in ASP.NET Core is role-based: a user belongs to roles, and endpoints require specific roles.

// User has roles: admin, editor
// Endpoint requires: admin

Where Roles Come From

A role is just a claim of type ClaimTypes.Role. When you issue a JWT, add one role claim per role the user holds.

var claims = new List<Claim>
{
    new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
    new Claim(ClaimTypes.Role, "admin"),
    new Claim(ClaimTypes.Role, "editor")
};

The Role Claim Type

For [Authorize(Roles=...)] and User.IsInRole to work, the handler must know which claim type represents a role.

The JWT key role maps to ClaimTypes.Role by default. If you use a custom key, tell the validator via RoleClaimType.

options.TokenValidationParameters = new TokenValidationParameters
{
    RoleClaimType = ClaimTypes.Role
};

Requiring a Single Role

Apply [Authorize(Roles = "admin")] to a controller or action. Only users with the admin role may enter.

[Authorize(Roles = "admin")]
[HttpDelete("users/{id}")]
public IActionResult DeleteUser(int id)
{
    // only admins reach here
    return NoContent();
}

Requiring Any of Several Roles

A comma-separated list means OR: the user needs at least one of the listed roles.

[Authorize(Roles = "admin,editor")]
[HttpPut("articles/{id}")]
public IActionResult Update(int id) => Ok();
// admins OR editors are allowed

Requiring Multiple Roles (AND)

To require all of several roles, stack multiple [Authorize] attributes. Each one must pass.

[Authorize(Roles = "employee")]
[Authorize(Roles = "manager")]
public IActionResult ApproveBudget() => Ok();
// must be BOTH employee AND manager

Checking Roles in Code

Sometimes you need a role check inside the method body, not just at the door. Use User.IsInRole.

public IActionResult GetReport()
{
    var data = BuildReport();
    if (User.IsInRole("admin"))
        data.IncludeSensitiveColumns();
    return Ok(data);
}

Minimal API Equivalent

Minimal APIs use .RequireAuthorization with an inline policy or, more simply, you can require a role through a named policy.

app.MapDelete("/users/{id}", (int id) => Results.NoContent())
   .RequireAuthorization(p => p.RequireRole("admin"));

Roles in a Hierarchy

ASP.NET Core has no built-in role hierarchy. If admins should implicitly have editor rights, either grant both role claims at login or model it with policies (next course).

// Grant both at login if admin >= editor
new Claim(ClaimTypes.Role, "admin");
new Claim(ClaimTypes.Role, "editor");

When Roles Fall Short

Roles are coarse-grained. When rules depend on data (e.g. "only the owner can edit") or fine-grained permissions, role checks become messy.

That is where claims-based and policy-based authorization come in.

// Hard to express with roles alone:
// "editors, but only for their own department"

Returning 403 vs 401

If the user is not authenticated, a role check yields 401 Unauthorized. If they are authenticated but lack the role, they get 403 Forbidden.

// No/invalid token         -> 401 Unauthorized
// Valid token, wrong role   -> 403 Forbidden

Quick Check

Test your role knowledge.

Answer it in the interactive lesson

Recap

You learned role-based authorization:

Roles are ClaimTypes.Role claims placed in the token.
[Authorize(Roles = "a,b")] means OR; stacking attributes means AND.
User.IsInRole checks roles in code.
Roles are coarse - data-driven rules need richer models.

Next: claims-based authorization.

Free to start

Learn C# with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 93
Lessons: 346

Start learning free View the full course

Frequently Asked Questions

Is the “Role-Based Authorization” lesson free?

Yes — the full text of “Role-Based Authorization” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the C# Academy course, upgrade to CoddyKit PRO. The C# Academy course includes 4 lessons in total.

What will I learn in “Role-Based Authorization”?

Restrict endpoints by user roles. You practise C# Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start C# Academy?

No prior experience is required. C# Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 1 of 4.

How long does the “Role-Based Authorization” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this C# Academy lesson?

Yes. Every C# Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to C# Academy