ASP.NET Core Minimal API Auth

In this tutorial, you'll learn about ASP.NET Core Minimal API Auth. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Your minimal API endpoints handle sensitive data but have no authorization. Anyone can access them.

Wrong

app.MapGet("/admin/users", () => GetUsers());
// No auth — anyone can access

Right

// Require authentication
app.MapGet("/api/me", (HttpContext ctx) =>
{
    var userId = ctx.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    return Results.Ok(new { UserId = userId });
}).RequireAuthorization();

// Require specific policy
app.MapGet("/admin/users", () => GetUsers())
    .RequireAuthorization("AdminOnly");

// With roles
app.MapDelete("/admin/users/{id}", (int id) => DeleteUser(id))
    .RequireAuthorization(pb => pb.RequireRole("Admin"));

Route group authorization:

var adminGroup = app.MapGroup("/admin")
    .RequireAuthorization("AdminOnly");

adminGroup.MapGet("/users", () => GetUsers());
adminGroup.MapDelete("/users/{id}", (int id) => DeleteUser(id));

Prevention

• Use RequireAuthorization() on individual endpoints or groups.
• Combine with JWT bearer or cookie authentication.
• Use policy-based authorization for fine-grained control.
• Apply authorization to route groups for consistency.
• Test unauthorized access returns 401/403.

Common Mistakes with core minimal auth

1. Placing the wildcard pattern first in case expressions, making all subsequent patterns unreachable
2. Using head and tail instead of pattern matching, causing runtime errors on empty lists
3. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks

These mistakes appear frequently in real-world ASPNET code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

Can I use policies with minimal APIs?

Learn more at DodaTech.