Identity, Tokens & Authorization

Order is not negotiable

app.UseAuthentication();   // validate token -> ClaimsPrincipal
app.UseAuthorization();    // evaluate policies against it
app.MapProductEndpoints(); // endpoints come after both

// no principal        -> 401 Unauthorized
// principal, denied   -> 403 Forbidden

Validating the token

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(o => o.TokenValidationParameters = new()
    {
        ValidIssuer = jwt.Issuer, ValidAudience = jwt.Audience,
        IssuerSigningKey = new SymmetricSecurityKey(keyBytes),
        ClockSkew = TimeSpan.FromSeconds(30),
    });

Signing key lives in user secrets / env — never appsettings.json. HS256 needs ≥ 32 bytes.

Authorization as policy

builder.Services.AddAuthorizationBuilder()
    .AddPolicy("Staff", p => p.RequireRole("Staff"))
    .AddPolicy("OwnsOrder", p => p.AddRequirements(new OwnsOrderRequirement()));

var staff = products.MapGroup("/").RequireAuthorization("Staff");
staff.MapPost("/", CreateProduct);   // and PUT, DELETE

Policy on the group → new endpoints are protected by default. Fail safe.

Resource-based authorization

protected override Task HandleRequirementAsync(
    AuthorizationHandlerContext ctx, OwnsOrderRequirement req, Order order)
{
    if (ctx.User.IsInRole("Staff") ||
        ctx.User.FindFirstValue("customer_id") == order.CustomerId.ToString())
        ctx.Succeed(req);
    return Task.CompletedTask;
}

Return 404 (not 403) for another customer's order — a 403 confirms it exists.