An API that anyone can call is rarely what you want. Before an application goes live, it needs to know who is making a request and what they are allowed to do. Getting this wrong is one of the most common and costly mistakes in real-world software, so it deserves its own module.
You'll start with the difference between authentication and authorization, and with how cookie-based sign-in works. Then you'll add JWT (JSON Web Token) authentication to a Web API, use ASP.NET Core Identity to manage users and roles, and finish with OAuth 2.0 and OpenID Connect, the standards behind "sign in with" buttons and single sign-on.
With your application secured, you'll be ready for the next module, Testing & CI/CD, where you learn to verify your code and ship it automatically.
Explains the difference between authentication and authorization, 401 versus 403 responses, why middleware order matters, and role-based and policy-based access control, with a live demo of secure cookie authentication and protected endpoints.
A step-by-step guide to adding JSON Web Token authentication to a .NET 10 Web API: installing the JwtBearer package, generating tokens, implementing authorization, and storing users with EF Core Code First.
Adds role-based access control to an ASP.NET Core MVC app with Identity: creating and assigning roles with the User Manager and Role Manager, seeding an admin user, and protecting controllers and actions with the Authorize attribute.
A plain-language explanation of OAuth 2.0 and OpenID Connect from an Okta developer advocate. It dates from 2018, so the Implicit Flow it describes is outdated, but the core concepts still apply.