Getting Authorization Right in .NET: Patterns, Pitfalls, and Practical Guidance - Michele Leroux Bustamante

This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity  #ndcconferences  #security  #developer   #softwaredeveloper    

Attend the next NDC conference near you: 
https://ndcconferences.com
https://ndc-security.com/

Subscribe to our YouTube channel and learn every day:  @NDC 

Follow our Social Media!

https://www.facebook.com/ndcconferences
https://twitter.com/NDC_Conferences
https://www.instagram.com/ndc_conferences

#applicationsecurity #programming #security #securitytools #dotnet #aspdotnet #api 

Authentication gets the spotlight, but authorization is where real access control happens—and getting it right is critical for secure and maintainable applications. This session dives deep into modern authorization patterns in .NET, helping you move beyond if(user.IsInRole()) to scalable, flexible, and secure designs using fine-grained authorization patterns.

The session will cover:
* The built-in authorization model in ASP.NET Core, including policies, roles, and claims
* Attribute-based vs. resource-based authorization
* Custom policy and handler development
* Managing fine-grained permissions across microservices and APIs
* Externalizing authorization decisions using centralized authorization systems
* Best practices for combining authentication (OIDC / OAuth2) with robust authorization logic
* Common pitfalls—like hardcoding roles or overloading claims—and how to avoid them

This session will equip you with the patterns and practices to build secure, testable, and future-proof authorization in .NET.

NDC Conferences

A conference talk covering authorization patterns in .NET and ASP.NET Core, with live demos. Topics include the difference between authentication and authorization, why coupling them causes problems like role explosion and token bloat, and how to implement progressively more sophisticated authorization: default and fallback policies, named policies with role/claim requirements, custom IAuthorizationRequirement handlers with DI, external policy loading (JSON, OPA, policy servers), endpoint metadata-based permissions, and feature-area authorization. The talk also covers applying authorization to Razor Pages and Minimal APIs, using tag helpers to show/hide UI elements based on permissions, step-up authentication, and architectural guidance on designing authorization upfront before writing code.

Getting Authorization Right in .NET: Patterns, Pitfalls... - Michele Leroux Bustamante