# aspnetcore-authorization

> Claude/Codex skill by [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars · Updated 2026-10-16

ASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations, scope-based authorization for APIs, authorization middleware configuration, and minimal API authorization.

Tags: ai-agents, claude, claude-code

## Install

```sh
git clone https://github.com/DuendeSoftware/duende-skills /tmp/duende-skills && ln -s /tmp/duende-skills/skills/aspnetcore-authorization ~/.claude/skills/aspnetcore-authorization
```

## From README

ASP.NET Core Authorization When to Use This Skill Use this skill when: Implementing policy-based authorization in ASP.NET Core Protecting API endpoints with scope-based or claim-based checks Writing custom IAuthorizationHandler implementations Configuring authorization for Minimal APIs, controllers, or Razor Pages Enforcing role-based access control using OIDC claims Combining multiple authorization requirements into composite policies Core Principles Policy-Based Over Role-Based — Use authorization policies instead of \[Authorize(Roles = "...")\]. Policies are composable, testable, and decoupled from claim types. Scope ≠ Permission — OAuth scopes represent what the client is allowed to do. User claims represent what the user is allowed to do. Combine both for proper API authorization. Authorization is Separate from Authentication — Authentication (see aspnetcore-authentication) establishes identity. Authorization decides access based on that identity.

## Links

- HTML page: https://omgskills.com/library/duendesoftware/duende-skills/skills/aspnetcore-authorization/
- GitHub: https://github.com/DuendeSoftware/duende-skills
- Author: [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md)

## More from this repo

- [aspnetcore-authentication](https://omgskills.com/library/duendesoftware/duende-skills/skills/aspnetcore-authentication/index.md) — ASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars
- [claims-authorization](https://omgskills.com/library/duendesoftware/duende-skills/skills/claims-authorization/index.md) — Claims transformation and profile service patterns for Duende IdentityServer — IProfileService, IClaimsTransformation,...
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars
- [duende-bff](https://omgskills.com/library/duendesoftware/duende-skills/skills/duende-bff/index.md) — Duende BFF (Backend for Frontend) security framework for securing SPAs.
   - [@duendesoftware](https://omgskills.com/library/duendesoftware/index.md) · 9 stars