The first authorization bug I ever shipped wasn't a missing [Authorize] attribute. It was the opposite — everything had [Authorize] , the tests were green, and it still let one user edit another user's stuff. The attribute was doing exactly what it promised.

Source: [Dev.to](https://dev.to/kazemmdev/authorize-cant-see-your-data-47pc)

Sponsored