One of the key ways to secure your application is to only allow sensitive operations to be executed by users who are authorized to perform them.
There is more than one way to perform authorization in your application: you can check each user against a whitelist; you can check if the user is part of a group (or role) that is allowed to use the functionality in question; or you can run sophisticated logic that makes sure that the user has the necessary access clearance. In this chapter, I'm going to teach you the two most broadly used techniques in the industry:
- Claim-based authorization: Each user is given a set of claims that can later be retrieved and checked. The claims include both personal attributes (such as the user's birth date), metadata (the registration time), and other pieces of information, such as the user permission set.
- Role-based authorization: Users are grouped together into meaningful permission groups that define the application...