LuisLlamas Logo
aspnet-core-autenticacion-vs-autorizacion-diferencias

Authentication and Authorization in ASP.NET Core

  • 3 min
  • Intermediate

The authentication checks who you are, while the authorization decides what you can do with that identity.

Confusing them leads to serious design errors (like returning a 401 error when you should return a 403) and security breaches.

Let’s clearly separate the questions “Who are you?” and “What can you do?”.

Main Differences

ConceptKey QuestionWhen it OccursIf it Fails it Returns…
Authentication (AuthN)Who are you?At the beginning (Login)401 Unauthorized
Authorization (AuthZ)What can you do?After Login403 Forbidden

Authentication (AuthN): Identity

The Authentication (often abbreviated as AuthN) is the process of verifying the identity of a user or service.

It answers the question: “Are you who you say you are?”.

It’s the bouncer at the nightclub asking for your ID. They don’t care if you’re going to drink water or champagne, they just want to know if the photo on the ID matches your face and if the document is valid.

Examples of Authentication:

  • Entering username and password in a Login form.
  • Using a fingerprint (Biometrics) to unlock your phone.
  • Sending an API Key in the header of a request.
  • Logging in with Google, Microsoft, or another external provider.

The result of successful authentication is an Identity (a User, a Token, a Cookie) that the system recognizes.

Authorization (AuthZ): Permissions

The Authorization (abbreviated as AuthZ) occurs after authentication. It is the process of verifying whether that identity has permission to perform a specific action.

It answers the question: “Do you have permission to do this?”.

Continuing with the nightclub analogy: you’re already inside (you’ve authenticated). Now you try to enter the VIP area. The security guard stops you and checks if you have the VIP wristband. They know who you are, but maybe you don’t have permission to be in that area.

Examples of Authorization:

  • “Can the user ‘Luis’ delete this article?”
  • “Does this user have the ‘Administrator’ role?”
  • “Does this App have permission to access my camera?”

Status Codes: 401 and 403

In the HTTP protocol, this difference is reflected in two status codes that are often confused:

Indicates that the request requires authentication or that the credentials sent are invalid.

  • Cause: You haven’t sent the token, or the token has expired.
  • Solution: Log in again.
  • Means: “I know who you are, but I will NOT let you in”.
  • Cause: You are logged in as a “Normal User” and trying to access an “Admin” route.
  • Solution: request more permissions or use an account with the correct role.

The Flow in ASP.NET Core

In our previous articles on Middleware, we saw this order in Program.cs:

var app = builder.Build();

// ... other middlewares ...

app.UseAuthentication(); // 1. Who are you? (AuthN)
app.UseAuthorization();  // 2. Can you pass? (AuthZ)

app.MapControllers();
Copied!

The order is important.

  1. UseAuthentication: Attempts to build a User (ClaimsPrincipal) from the cookie or token that comes in the request. If successful, it stores it in HttpContext.User.
  2. UseAuthorization: Looks at the HttpContext.User. If the endpoint has an [Authorize(Roles = "Admin")] attribute, it checks if that user has that role.

Code Example

[Authorize] // 1. Requires Authentication (Anyone with a valid user can enter)
public class DocumentosController : ControllerBase
{
    [HttpGet]
    public IActionResult Leer() => Ok("Public document for users");

    [Authorize(Roles = "Admin")] // 2. Requires specific Authorization (Admins only)
    [HttpDelete]
    public IActionResult Borrar() => Ok("Document deleted");
}
Copied!
  • If an anonymous user accesses Leer() -> 401 Unauthorized.
  • If a normal user accesses Leer() -> 200 OK.
  • If a normal user accesses Borrar() -> 403 Forbidden.

On this page