PrismitaLEARN · PRACTICE · GROW

What is the difference between authentication and authorization in ASP.NET Core?

ASP.NET Core Authentication Basic 1–2 Yrs2–3 Yrs Conceptual 1 min read

Quick Answer

Authentication establishes who the caller is — it validates a cookie, JWT or other credential and builds a ClaimsPrincipal. Authorization decides whether that identity is allowed to do this action — via [Authorize], roles, or policies. Authentication returns 401; authorization returns 403.

Authentication is “who are you” — it validates the credential, a cookie or a JWT, and builds the ClaimsPrincipal on HttpContext.User. Authorization is “are you allowed to do this” — it checks roles or policies against that identity. Authentication failing gives a 401, authorization failing gives a 403. In the pipeline UseAuthentication has to run before UseAuthorization because you can't check permissions before you know the user, and both run after routing so authorization knows which endpoint it's guarding. I prefer policy-based authorization over role checks because policies are easier to test and evolve.

  • In the pipeline, UseAuthentication() must come before UseAuthorization() — you can't check permissions until you know who's asking. Both come after UseRouting() so authorization knows which endpoint is being protected.
  • Authentication schemes: cookies (server-rendered apps), JWT bearer (APIs/SPAs), OpenID Connect (external IdP).
  • Authorization models: [Authorize(Roles = "Admin")], or policies — [Authorize(Policy = "CanApprove")] backed by requirements and handlers, which is more flexible and testable.
  • Claims: authentication puts claims on User (name, role, tenant); authorization reads them.
All ASP.NET Core questions More on Authentication