The Claims Map That Does Not Exist
The README and the sample both configure an auth claims alias map, the configuration class has no such property, and the binder's ignore-unknown-keys behaviour is what makes the omission silent.
Archive
Every article
Newest first, grouped by year. Search or filter by topic.
- 556 articles
- 6 matching
All
.NET
AI Engineering
Architecture
Azure & DevOps
Data Warehousing
Engineering Practice
Microservices
Web APIs
authorization ×
The Policy That Was Never Applied
Trill's gateway declares an authenticatedUser authorisation policy exactly once and attaches it to nothing - and its identity middleware returns early when the Authorization header is absent, so a caller with no token at all can publish commands onto the estate's message bus.
Endpoints Declared as Data
A four-field record that makes it impossible to register a route without stating who may call it - the best idea in the mini-framework - and the one line it did not write, which costs every 404 in the estate.
A Policy Per Endpoint: How Declarative Security Compiles
Permissions(), Claims() and Scopes() in Configure() feel like magic until you read the mapping code - every endpoint gets its own named authorization policy built from closures at startup, and roles ride a plain AuthorizeAttribute. Part 7 of FastEndpoints in Depth.
A Timer You Can Stop from an Email
A work-from-home swipe modelled as a state machine, a stop-from-email deep link, the estate's one deliberate IDOR guard that compares instead of overwrites, and a DbContext constructed by hand inside the action.
Compiling Authorization Out of Debug Builds
Every controller wrapped its Authorize attribute in