gateway-security

Configure JWT authentication and policy-based authorization for ASP.NET Core gateway endpoints.

4|1|Updated Mar 15, 2026

Search Tags:#authorization #security #jwt #dotnet #aspnetcore #policies #gateway

Ready to run

npx skills add https://github.com/FaysilAlshareef/dotnet-ai-kit --skill gateway-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gateway-security
Source: https://github.com/FaysilAlshareef/dotnet-ai-kit/tree/main/skills/microservice/gateway/gateway-security
Command: npx skills add https://github.com/FaysilAlshareef/dotnet-ai-kit --skill gateway-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Securing gateway endpoints with consistent authentication and authorization reduces misconfigurations and security gaps across microservices, ensuring a unified security posture.

Core Features & Use Cases

JWT authentication integration: AddJwtAuthentication extension configures JWT Bearer authentication from the Jwt section of the configuration.
Policy-based authorization: AddPolicies extension registers policies and handlers to enforce ApiScope-based access and custom requirements across gateway endpoints.
Centralized security primitives: Policy constants, Roles constants, and Authorization Handlers provide reusable, testable security primitives for controllers and actions.
Flexible integration patterns: Demonstrates default [Authorize], policy-based [Authorize(Policy = ...)], and role-based [Authorize(Roles = ...)] usage across controllers.

Quick Start

Configure your gateway to enable JWT authentication and policy-based access by wiring AddJwtAuthentication and AddPolicies in startup.

Frequently Asked Questions about gateway-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure JWT authentication for an ASP.NET Core gateway?▼

JWT authentication for an ASP.NET Core gateway is configured using the AddJwtAuthentication extension, which sets up JWT Bearer authentication from the Jwt section of your application configuration. This ensures consistent token validation across gateway endpoints.

What is the best way to enforce policy-based authorization in a microservices gateway?▼

Policy-based authorization in a microservices gateway is enforced by registering the AddPolicies extension, which maps custom requirements and ApiScope-based access to specific controllers and actions. This centralizes security logic and reduces misconfigurations across services.

Can I use role-based and policy-based authorization together in ASP.NET Core?▼

Role-based and policy-based authorization can be used together in ASP.NET Core by applying flexible integration patterns. You can secure endpoints using default [Authorize], [Authorize(Policy = ...)] for custom requirements, or [Authorize(Roles = ...)] for role-based access.

When do I need custom authorization handlers for gateway endpoints?▼

Custom authorization handlers are needed for gateway endpoints when enforcing specific ApiScope-based access or custom policy requirements that standard role checks cannot cover. They provide reusable, testable security primitives for evaluating user claims.

Does this JWT gateway security approach work without additional dependencies?▼

This JWT gateway security approach works without additional dependencies, relying entirely on built-in ASP.NET Core components. It provides centralized security primitives, policy constants, and extension methods to wire authentication directly in startup.

Why does my gateway need centralized JWT authentication instead of service-level security?▼

A gateway needs centralized JWT authentication instead of service-level security to ensure a unified security posture across microservices. Centralizing token validation and policy enforcement reduces misconfigurations and security gaps in distributed environments.