Tag: authorization

All the articles with the tag "authorization".

• Three ways to say [Authorize], one way to check it: fixing ASP.NET Core's security-metadata guard

  22 Oct, 2026

  ASP.NET Core routing refuses to run an endpoint whose authorization metadata nothing will enforce. That guard only recognized one of the three kinds of authorization metadata. Notes on PR #67742: where the gap was, a short-circuited endpoint that served 200 without authentication on .NET 10, and the fix.