Loading…

🧪 Unit & Integration Testing Authorization in ASP.NET Core · devs3

Account

#dotnet #authorization #dotnet-core #aspdotnet #unit-test #authontication

🧪 Unit & Integration Testing Authorization in ASP.NET Core

By Samim Hossain · March 29, 2026 · 3 min read · 149 views

Authorization logic is security-critical.
If it isn’t tested, it will break silently.

In this article, we’ll cover how to unit test and integration test authorization in ASP.NET Core, including roles, claims, policies, and custom handlers.

Why Test Authorization?

Authorization bugs can:

Expose sensitive data
Allow privilege escalation
Break compliance rules
Go unnoticed until production

👉 Testing ensures only the right users access the right resources.

What Should Be Tested?

plaintext

| Layer             | What to Test                   |
| ----------------- | ------------------------------ |
| Unit Tests        | Policies, handlers, role logic |
| Integration Tests | Endpoint access                |
| E2E (optional)    | Full auth flow                 |

We’ll focus on .

Join the conversation

Comments

Add a comment

No comments yet. Start the conversation.

#c#

.NET প্রজেক্টে Two-Factor Authentication (2FA) Enable করার সহজ গাইড

3 min read

#dotnet

Beyond Free: Unpacking the Real Costs of .NET Development

2 min read

[Fact]
public async Task FinanceOnlyPolicy_ShouldSucceed_ForFinanceUser()
{
    var requirement = new ClaimsAuthorizationRequirement(
        "department", new[] { "finance" });

    var user = new ClaimsPrincipal(new ClaimsIdentity(new[]
    {
        new Claim("department", "finance")
    }));

    var context = new AuthorizationHandlerContext(
        new[] { requirement }, user, null);

    var handler = new ClaimsAuthorizationHandler();

    await handler.HandleAsync(context);

    Assert.True(context.HasSucceeded);
}

[Fact]
public void User_With_Admin_Role_Should_Be_Authorized()
{
    var user = new ClaimsPrincipal(new ClaimsIdentity(new[]
    {
        new Claim(ClaimTypes.Role, "Admin")
    }, "TestAuth"));

    Assert.True(user.IsInRole("Admin"));
}

[Fact]
public async Task AgeRequirement_Should_Succeed_When_Age_Is_Valid()
{
    var requirement = new MinimumAgeRequirement(18);

    var user = new ClaimsPrincipal(new ClaimsIdentity(new[]
    {
        new Claim("age", "20")
    }));

    var context = new AuthorizationHandlerContext(
        new[] { requirement }, user, null);

    var handler = new MinimumAgeHandler();

    await handler.HandleAsync(context);

    Assert.True(context.HasSucceeded);
}

public class TestAppFactory : WebApplicationFactory<Program>
{
    protected override void ConfigureWebHost(IWebHostBuilder builder)
    {
        builder.ConfigureServices(services =>
        {
            services.AddAuthentication("Test")
                .AddScheme<AuthenticationSchemeOptions, TestAuthHandler>(
                    "Test", options => { });
        });
    }
}

public class TestAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    public TestAuthHandler(
        IOptionsMonitor<AuthenticationSchemeOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder,
        ISystemClock clock)
        : base(options, logger, encoder, clock) { }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        var claims = new[]
        {
            new Claim(ClaimTypes.Role, "Admin"),
            new Claim("department", "finance")
        };

        var identity = new ClaimsIdentity(claims, "Test");
        var principal = new ClaimsPrincipal(identity);
        var ticket = new AuthenticationTicket(principal, "Test");

        return Task.FromResult(AuthenticateResult.Success(ticket));
    }
}

[Fact]
public async Task Admin_Endpoint_Should_Return_200_For_Admin()
{
    var factory = new TestAppFactory();
    var client = factory.CreateClient();

    var response = await client.GetAsync("/admin/dashboard");

    Assert.Equal(HttpStatusCode.OK, response.StatusCode);
}

[Fact]
public async Task Unauthorized_User_Should_Get_403()
{
    var client = new WebApplicationFactory<Program>().CreateClient();

    var response = await client.GetAsync("/admin/dashboard");

    Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
}

plaintext

| Feature         | Coverage |
| --------------- | -------- |
| Roles           | ✅        |
| Claims          | ✅        |
| Policies        | ✅        |
| Custom handlers | ✅        |
| API endpoints   | ✅        |

🧪 Unit & Integration Testing Authorization in ASP.NET Core

Why Test Authorization?

What Should Be Tested?

Join the conversation

Comments

.NET প্রজেক্টে Two-Factor Authentication (2FA) Enable করার সহজ গাইড

Beyond Free: Unpacking the Real Costs of .NET Development

Testing Tools

1️⃣ Unit Testing Authorization Policies

Example Policy

Unit Test the Policy

2️⃣ Unit Testing Role-Based Authorization

Controller Example

Unit Test

3️⃣ Unit Testing Custom Authorization Handlers

Custom Requirement

Handler Test

4️⃣ Integration Testing Authorization (Real API Calls)

Setting Up Integration Tests

Install Package

Custom WebApplicationFactory

Fake Authentication Handler

Integration Test Example

Testing Unauthorized Access

Best Practices for Authorization Testing

What Not to Test

Recommended Test Coverage

Real-World Use Cases

Why Test Authorization?

What Should Be Tested?

Join the conversation

Comments

Keep reading

.NET প্রজেক্টে Two-Factor Authentication (2FA) Enable করার সহজ গাইড

Beyond Free: Unpacking the Real Costs of .NET Development

Testing Tools

1️⃣ Unit Testing Authorization Policies

Example Policy

Unit Test the Policy

2️⃣ Unit Testing Role-Based Authorization

Controller Example

Unit Test

3️⃣ Unit Testing Custom Authorization Handlers

Custom Requirement

Handler Test

4️⃣ Integration Testing Authorization (Real API Calls)

Setting Up Integration Tests

Install Package

Custom WebApplicationFactory

Fake Authentication Handler

Integration Test Example

Testing Unauthorized Access

Best Practices for Authorization Testing

What Not to Test

Recommended Test Coverage

Real-World Use Cases