One of the key ways to secure your application is to only allow sensitive operations to be executed by users who are authorized to perform them.

There is more than one way to perform authorization in your application: you can check each user against a whitelist; you can check if the user is part of a group (or role) that is allowed to use the functionality in question; or you can run sophisticated logic that makes sure that the user has the necessary access clearance. In this chapter, I'm going to teach you the two most broadly used techniques in the industry:

• Claim-based authorization: Each user is given a set of claims that can later be retrieved and checked. The claims include both personal attributes (such as the user's birth date), metadata (the registration time), and other pieces of information, such as the user permission set. 
• Role-based authorization: Users are grouped together into meaningful permission groups that define the application roles. Each user is assigned to one or more roles, and the application can later check if a user can access a resource or perform an operation, based on the role(s) the user has. 

Previously in this chapter, you learned how to add claims to the user token; now, I'll show you how you can retrieve the claim value and use it to authorize users.