Getting Authorization Right in .NET: Patterns, Pitfalls, and Practical Guidance

Item: Getting Authorization Right in .NET: Patterns, Pitfalls, and Practical Guidance
Rating: 4
Author: PostSingularity Institute

by Michele Leroux Bustamante

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information Technology URComputer security

🎙 Michele Leroux Bustamante 👥 227K 📅 March 12, 2026 ⏱ 66 min 👁 5K 📄 tutorial 🧭 2026-08-13

Available in: English (current) Français

Keywords

authorizationASP.NET Corepoliciesrolesclaims

Summary

Michele Leroux Bustamante’s talk at NDC Security 2026 focuses on authorization in .NET, emphasizing that authorization is harder than authentication and requires careful architecture. She distinguishes between authentication (who you are) and authorization (what you can do), and warns against coupling them, which can lead to role explosion and token bloat. The talk covers various authorization models: role-based, permission-based, attribute-based, resource-based, and policy-based. She demonstrates practical implementations in ASP.NET Core, including default and fallback policies, attribute-based vs. declarative configuration, and creating custom policies. She also discusses common pitfalls like hardcoding roles, overloading claims, and the importance of separating identity from business logic. The session includes live demos showing how to secure APIs with policies, handle anonymous access, and use minimal APIs. She concludes with best practices for designing scalable and maintainable authorization systems, and mentions externalizing authorization decisions using centralized systems and the emerging AuthZ protocol.

146 words

Critical Evaluation

Value of the Information & Strength of the Argument

The talk provides high practical value for developers working with .NET, offering concrete code examples and patterns for implementing authorization. The argumentation is solid, based on the speaker’s extensive experience and common industry practices. She clearly explains the trade-offs between different authorization approaches and emphasizes the importance of planning and separating concerns. The live demos effectively illustrate the concepts, making the content actionable.

72 words

Title / Content Match

The title accurately reflects the content, which focuses on authorization patterns, pitfalls, and practical guidance in .NET.

Quality & Reliability

8/10

The talk is presented by an experienced practitioner, with live coding demonstrations and practical guidance. It covers well-established patterns and pitfalls in .NET authorization, but lacks formal citations or references to external sources, relying on the speaker's expertise.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

NDC Security Conference — Conference where the talk was recorded
NDC Conferences — Organizer of the conference

Concurring Sources

ASP.NET Core authorization documentation — Official documentation supporting the patterns discussed

Contribution & Novelties

The talk provides a comprehensive overview of authorization patterns in .NET, with practical demos and guidance. It emphasizes the importance of separating authentication and authorization, and offers strategies for avoiding common pitfalls like role explosion and token bloat. The session is particularly valuable for developers looking to implement fine-grained authorization in ASP.NET Core applications.

Pour aller plus loin :

ASP.NET Core authorization documentation — Official documentation on authorization in ASP.NET Core.
OpenID Connect — Protocol for authentication, relevant to the talk’s discussion on OIDC.
OAuth 2.0 — Authorization framework, relevant to API scopes and token handling.

96 words

Radar Profile

The radar profile shows high scores in information quantity, quality, and reliability, with a slightly lower technical level, indicating a talk that is accessible yet informative. The balance between practical examples and theoretical concepts is well maintained.

Reliability 8/10