Loading
Topic
Roles, permissions, capabilities, policy authorization, resource ownership, tenant membership, admin actions, and stale permission handling.
Practice items tagged with API Authorization.
Explains how ASP.NET Core schemes select handlers and why authenticate, challenge, and forbid produce different security behavior.
Explains why sensitive admin actions need authorization, reason capture, before/after context, and tamper-resistant audit records.
Explains API keys, client credentials, managed identity, mTLS, scopes, rotation, and per-client observability.
Loads a resource once, evaluates owner-or-capability authorization, and avoids trusting route ownership claims.
Explains trusted tenant context, membership checks, tenant-scoped queries, cache keys, and background job propagation.
Explains how roles group permissions while API policies enforce specific capabilities and resource rules.