Why ASP.NET Core's [Authorize] Attribute Cannot Protect Individual Data Rows

A common authorization mistake in ASP.NET Core is assuming the [Authorize] attribute can verify whether a user owns a specific database record, when it only checks whether a user is permitted to access an endpoint. The attribute runs before any data is loaded, meaning it can evaluate roles and claims but has no visibility into the actual resource being requested. For row-level or resource-level access control, developers must use IAuthorizationService, which is called after the resource is loaded and passes the object directly into a custom authorization handler. The handler can then compare the resource's owner identifier against the authenticated user's claims to allow or deny the action. The article also warns against loosening token clock skew defaults and advises using established identity providers rather than hand-rolling authentication logic.