Today, when building web applications, security has to be a top priority. An easy mistake to make is forgetting to add the [Authorize] attribute to controllers or actions inside your ASP.NET Core backend. This creates a security vulnerability where sensitive pages become accessible to unauthenticated users.
Of course, you could create a SecureBaseController class that includes this attribute but now you need to remember to inherit from this base class.
Instead of remembering to secure every single endpoint, what if we could flip the script and make authentication the default?
Setting an Authorization Fallback Policy
ASP.NET Core provides a powerful feature called the Authorization Fallback Policy. This allows you to require authentication globally across your entire application, making security the default rather than an opt-in feature.
To implement it, in your Program.cs file, configure the authorization services with a fallback policy that requires authenticated users:
This simple configuration ensures that all endpoints require authentication by default.
Now that authentication is required everywhere, you need to explicitly mark which endpoints should be publicly accessible:
Important to notice is that this is only a first line of defense, preventing an unauthenticated user to access your website. The next layer is to implement authorization.
Remember: in security, it's better to fail closed (deny by default) than to fail open (allow by default). The fallback policy helps you achieve exactly that.