diff --git a/src/WopiHost.Abstractions/IWopiAuthorizationRequirement.cs b/src/WopiHost.Abstractions/IWopiAuthorizationRequirement.cs
new file mode 100644
index 00000000..cafe80af
--- /dev/null
+++ b/src/WopiHost.Abstractions/IWopiAuthorizationRequirement.cs
@@ -0,0 +1,41 @@
+namespace WopiHost.Abstractions;
+
+/// <summary>
+/// The Wopi resource type
+/// </summary>
+public enum WopiResourceType
+{
+    /// <summary>
+    /// <see cref="IWopiFile"/>
+    /// </summary>
+    File,
+    /// <summary>
+    /// <see cref="IWopiFolder"/>
+    /// </summary>
+    Container
+};
+
+
+/// <summary>
+/// Represents an authorization requirement for a given combination of resource, user, and action.
+/// </summary>
+/// <remarks>
+/// Creates an instance of <see cref="IWopiAuthorizationRequirement"/> initialized
+/// </remarks>
+public interface IWopiAuthorizationRequirement
+{
+    /// <summary>
+    /// Gets a permissions required for a given combination of resource, user, and action.
+    /// </summary>
+    Permission Permission { get; }
+
+    /// <summary>
+    /// Gets the type of the resource.
+    /// </summary>
+    WopiResourceType ResourceType { get; }
+
+    /// <summary>
+    /// Gets or sets the identifier of the resource.
+    /// </summary>
+    string? ResourceId { get; set; }
+}
diff --git a/src/WopiHost.Abstractions/IWopiSecurityHandler.cs b/src/WopiHost.Abstractions/IWopiSecurityHandler.cs
index be49ac6d..1f5b7cd2 100644
--- a/src/WopiHost.Abstractions/IWopiSecurityHandler.cs
+++ b/src/WopiHost.Abstractions/IWopiSecurityHandler.cs
@@ -29,11 +29,10 @@ public interface IWopiSecurityHandler
     /// Verifies whether the given principal is authorized to perform a given operation on the given resource.
     /// </summary>
     /// <param name="principal">User principal object</param>
-    /// <param name="resourceId">Identifier of a resource</param>
-    /// <param name="operation">Type of operation to be performed</param>
+    /// <param name="requirement">Type of operation to be performed</param>
     /// <param name="cancellationToken">Cancellation token</param>
     /// <returns>TRUE if the given principal is authorized to perform a given operation on the given resource.</returns>
-    Task<bool> IsAuthorized(ClaimsPrincipal principal, string resourceId, WopiAuthorizationRequirement operation, CancellationToken cancellationToken = default);
+    Task<bool> IsAuthorized(ClaimsPrincipal principal, IWopiAuthorizationRequirement requirement, CancellationToken cancellationToken = default);
 
 	/// <summary>
 	/// Returns a string representation of a <see cref="SecurityToken"/>
diff --git a/src/WopiHost.Abstractions/WopiAuthorizationRequirement.cs b/src/WopiHost.Abstractions/WopiAuthorizationRequirement.cs
deleted file mode 100644
index 7288318d..00000000
--- a/src/WopiHost.Abstractions/WopiAuthorizationRequirement.cs
+++ /dev/null
@@ -1,18 +0,0 @@
-using Microsoft.AspNetCore.Authorization;
-
-namespace WopiHost.Abstractions;
-
-/// <summary>
-/// Represents an authorization requirement for a given combination of resource, user, and action.
-/// </summary>
-/// <remarks>
-/// Creates an instance of <see cref="WopiAuthorizationRequirement"/> initialized with <paramref name="permission"/>.
-/// </remarks>
-/// <param name="permission">Permissions required for a given combination of resource, user, and action.</param>
-public class WopiAuthorizationRequirement(Permission permission) : IAuthorizationRequirement
-{
-    /// <summary>
-    /// Gets a permissions required for a given combination of resource, user, and action.
-    /// </summary>
-    public Permission Permission { get; } = permission;
-}
diff --git a/src/WopiHost.Abstractions/WopiCheckFileInfo.cs b/src/WopiHost.Abstractions/WopiCheckFileInfo.cs
index 05b120c6..bd2a0213 100644
--- a/src/WopiHost.Abstractions/WopiCheckFileInfo.cs
+++ b/src/WopiHost.Abstractions/WopiCheckFileInfo.cs
@@ -457,6 +457,7 @@ public class WopiCheckFileInfo : IWopiHostCapabilities
     /// A string value indicating the domain that the host page is sending and receiving PostMessages to and from. 
     /// Microsoft 365 for the web only sends outgoing PostMessages to this domain, and only listens to PostMessages from this domain.
     /// </summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     public string? PostMessageOrigin { get; set; }
 
     /// <summary>
diff --git a/src/WopiHost.Core/Controllers/ContainersController.cs b/src/WopiHost.Core/Controllers/ContainersController.cs
index 32dc8c2e..f89f2d77 100644
--- a/src/WopiHost.Core/Controllers/ContainersController.cs
+++ b/src/WopiHost.Core/Controllers/ContainersController.cs
@@ -4,6 +4,7 @@
 using Microsoft.Extensions.Options;
 using WopiHost.Abstractions;
 using WopiHost.Core.Models;
+using WopiHost.Core.Security.Authorization;
 
 namespace WopiHost.Core.Controllers;
 
@@ -18,7 +19,7 @@ namespace WopiHost.Core.Controllers;
 /// <param name="wopiHostOptions">WOPI Host configuration</param>
 [Route("wopi/[controller]")]
 public class ContainersController(
-    IWopiStorageProvider storageProvider, 
+    IWopiStorageProvider storageProvider,
     IWopiSecurityHandler securityHandler,
     IOptions<WopiHostOptions> wopiHostOptions) : WopiControllerBase(storageProvider, securityHandler, wopiHostOptions)
 {
@@ -31,6 +32,7 @@ public class ContainersController(
     /// <returns></returns>
     [HttpGet("{id}")]
     [Produces(MediaTypeNames.Application.Json)]
+    [WopiAuthorize(Permission.Read, WopiResourceType.Container)]
     public CheckContainerInfo GetCheckContainerInfo(string id)
     {
         var container = StorageProvider.GetWopiContainer(id);
@@ -48,6 +50,7 @@ public CheckContainerInfo GetCheckContainerInfo(string id)
     /// <param name="id">Container identifier.</param>
     /// <returns></returns>
     [HttpGet("{id}/children")]
+    [WopiAuthorize(Permission.Read, WopiResourceType.Container)]
     [Produces(MediaTypeNames.Application.Json)]
     public Container EnumerateChildren(string id)
     {
diff --git a/src/WopiHost.Core/Controllers/FilesController.cs b/src/WopiHost.Core/Controllers/FilesController.cs
index 40e43ff5..ce3f1026 100644
--- a/src/WopiHost.Core/Controllers/FilesController.cs
+++ b/src/WopiHost.Core/Controllers/FilesController.cs
@@ -1,7 +1,6 @@
 using System.Net.Mime;
 using System.Security.Claims;
 using System.Text.Json;
-using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Http.Features;
 using Microsoft.AspNetCore.Mvc;
@@ -11,7 +10,7 @@
 using WopiHost.Core.Infrastructure;
 using WopiHost.Core.Models;
 using WopiHost.Core.Results;
-using WopiHost.Core.Security;
+using WopiHost.Core.Security.Authorization;
 
 namespace WopiHost.Core.Controllers;
 
@@ -27,7 +26,6 @@ public class FilesController : WopiControllerBase
     /// </summary>
     private readonly ICobaltProcessor? cobaltProcessor;
     private readonly IWopiLockProvider? lockProvider;
-    private readonly IAuthorizationService authorizationService;
     private WopiHostCapabilities HostCapabilities => new()
     {
         SupportsCobalt = cobaltProcessor is not null,
@@ -45,18 +43,15 @@ public class FilesController : WopiControllerBase
     /// <param name="storageProvider">Storage provider instance for retrieving files and folders.</param>
     /// <param name="securityHandler">Security handler instance for performing security-related operations.</param>
     /// <param name="wopiHostOptions">WOPI Host configuration</param>
-    /// <param name="authorizationService">An instance of authorization service capable of resource-based authorization.</param>
     /// <param name="lockProvider">An instance of the lock provider.</param>
     /// <param name="cobaltProcessor">An instance of a MS-FSSHTTP processor.</param>
     public FilesController(
         IWopiStorageProvider storageProvider,
         IWopiSecurityHandler securityHandler,
         IOptions<WopiHostOptions> wopiHostOptions,
-        IAuthorizationService authorizationService,
         IWopiLockProvider? lockProvider = null,
         ICobaltProcessor? cobaltProcessor = null) : base(storageProvider, securityHandler, wopiHostOptions)
     {
-        this.authorizationService = authorizationService ?? throw new ArgumentNullException(nameof(authorizationService));
         this.lockProvider = lockProvider;
         this.cobaltProcessor = cobaltProcessor;
     }
@@ -70,13 +65,9 @@ public FilesController(
     /// <param name="cancellationToken">Cancellation token</param>
     /// <returns></returns>
     [HttpGet("{id}")]
+    [WopiAuthorize(Permission.Read, WopiResourceType.File)]
     public async Task<IActionResult> GetCheckFileInfo(string id, CancellationToken cancellationToken = default)
     {
-        if (!(await authorizationService.AuthorizeAsync(User, new FileResource(id), WopiOperations.Read)).Succeeded)
-        {
-            return Unauthorized();
-        }
-
         // Get file
         var file = StorageProvider.GetWopiFile(id);
         if (file is null)
@@ -107,17 +98,12 @@ public async Task<IActionResult> GetCheckFileInfo(string id, CancellationToken c
     /// <param name="cancellationToken">Cancellation token</param>
     /// <returns>FileStreamResult</returns>
     [HttpGet("{id}/contents")]
+    [WopiAuthorize(Permission.Read, WopiResourceType.File)]
     public async Task<IActionResult> GetFile(
         string id,
         [FromHeader(Name = WopiHeaders.MAX_EXPECTED_SIZE)] int? maximumExpectedSize = null,
         CancellationToken cancellationToken = default)
     {
-        // Check permissions
-        if (!(await authorizationService.AuthorizeAsync(User, new FileResource(id), WopiOperations.Read)).Succeeded)
-        {
-            return Unauthorized();
-        }
-
         // Get file
         var file = StorageProvider.GetWopiFile(id);
         if (file is null)
@@ -157,20 +143,13 @@ public async Task<IActionResult> GetFile(
     /// <returns>Returns <see cref="StatusCodes.Status200OK"/> if succeeded.</returns>
     [HttpPut("{id}/contents")]
     [HttpPost("{id}/contents")]
+    [WopiAuthorize(Permission.Update, WopiResourceType.File)]
     public async Task<IActionResult> PutFile(
         string id,
         [FromHeader(Name = WopiHeaders.LOCK)] string? newLockIdentifier = null,
         CancellationToken cancellationToken = default)
     {
-        // Check permissions
-        var authorizationResult = await authorizationService.AuthorizeAsync(User, new FileResource(id), WopiOperations.Update);
-
-        if (!authorizationResult.Succeeded)
-        {
-            return Unauthorized();
-        }
-
-        // https://learn.microsoft.com/microsoft-365/cloud-storage-partner-program/online/scenarios/createnew
+        // https://learn.microsoft.com/en-us/microsoft-365/cloud-storage-partner-program/online/scenarios/createnew
         var file = StorageProvider.GetWopiFile(id);
         // If ... missing altogether, the host should respond with a 409 Conflict
         if (file is null)
@@ -217,6 +196,7 @@ await HttpContext.Request.Body.CopyToAsync(
     /// <param name="id">File identifier.</param>
     /// <returns>Returns <see cref="StatusCodes.Status200OK"/> if succeeded.</returns>
     [HttpPost("{id}"), WopiOverrideHeader([WopiFileOperations.PutRelativeFile])]
+    [WopiAuthorize(Permission.Update, WopiResourceType.File)]
     public Task<IActionResult> PutRelativeFile(string id) => throw new NotImplementedException($"{nameof(PutRelativeFile)} is not implemented yet.");
 
     /// <summary>
@@ -228,16 +208,12 @@ await HttpContext.Request.Body.CopyToAsync(
     /// <param name="id">File identifier.</param>
     /// <param name="correlationId"></param>
     [HttpPost("{id}"), WopiOverrideHeader([WopiFileOperations.Cobalt])]
+    [WopiAuthorize(Permission.Update, WopiResourceType.File)]
     public async Task<IActionResult> ProcessCobalt(
         string id,
         [FromHeader(Name = WopiHeaders.CORRELATION_ID)] string? correlationId = null)
     {
         ArgumentNullException.ThrowIfNull(cobaltProcessor);
-        // Check permissions
-        if (!(await authorizationService.AuthorizeAsync(User, new FileResource(id), WopiOperations.Update)).Succeeded)
-        {
-            return Unauthorized();
-        }
 
         var file = StorageProvider.GetWopiFile(id);
 
diff --git a/src/WopiHost.Core/Security/Authentication/AccessTokenHandler.cs b/src/WopiHost.Core/Security/Authentication/AccessTokenHandler.cs
index 5878d0ec..deb44f03 100644
--- a/src/WopiHost.Core/Security/Authentication/AccessTokenHandler.cs
+++ b/src/WopiHost.Core/Security/Authentication/AccessTokenHandler.cs
@@ -33,6 +33,11 @@ protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
         {
             //TODO: implement access_token_ttl https://learn.microsoft.com/openspecs/office_protocols/ms-wopi/adb48ba9-118a-43b6-82d7-9a508aad1583	
 
+            if (Context.Request.Path.Value?.StartsWith("/wopi", StringComparison.OrdinalIgnoreCase) != true)
+            {
+                return AuthenticateResult.NoResult();
+            }
+
             var token = Context.Request.Query[AccessTokenDefaults.ACCESS_TOKEN_QUERY_NAME].ToString();
 
             if (Context.Request.Path.Value == "/wopibootstrapper")
@@ -43,6 +48,7 @@ protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
                     await securityHandler.GenerateAccessToken("Anonymous", Convert.ToBase64String(Encoding.UTF8.GetBytes(".\\"))));
             }
 
+
             if (!string.IsNullOrEmpty(token))
             {
                 var principal = await securityHandler.GetPrincipal(token);
diff --git a/src/WopiHost.Core/Security/Authorization/WopiAuthorizationHandler.cs b/src/WopiHost.Core/Security/Authorization/WopiAuthorizationHandler.cs
index a09770c4..8f5b2035 100644
--- a/src/WopiHost.Core/Security/Authorization/WopiAuthorizationHandler.cs
+++ b/src/WopiHost.Core/Security/Authorization/WopiAuthorizationHandler.cs
@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
 using WopiHost.Abstractions;
 
 namespace WopiHost.Core.Security.Authorization;
@@ -10,18 +11,26 @@ namespace WopiHost.Core.Security.Authorization;
 /// Creates an instance of <see cref="WopiAuthorizationHandler"/>.
 /// </remarks>
 /// <param name="securityHandler">AuthNZ handler.</param>
-public class WopiAuthorizationHandler(IWopiSecurityHandler securityHandler) 
-    : AuthorizationHandler<WopiAuthorizationRequirement, FileResource>
+public class WopiAuthorizationHandler(IWopiSecurityHandler securityHandler)
+    : AuthorizationHandler<WopiAuthorizeAttribute, HttpContext>
 {
     /// <summary>
     /// Performs resource-based authorization check.
     /// </summary>
     /// <param name="context">Context of the <see cref="AuthorizationHandler{TRequirement, TResource}"/></param>
-    /// <param name="requirement">Security requirement to be fulfilled (e.g. a permission).</param>
-    /// <param name="resource">Resource to check the security authorization requirement against.</param>
-    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, WopiAuthorizationRequirement requirement, FileResource resource)
+    /// <param name="requirement">Security requirement to be fulfilled (a permission on which resource).</param>
+    /// <param name="resource">httpContext resource</param>
+    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, WopiAuthorizeAttribute requirement, HttpContext resource)
     {
-        if (await securityHandler.IsAuthorized(context.User, resource.FileId, requirement))
+        // try to retrieve resource identifier from the route
+        if (resource.Request.RouteValues.TryGetValue("id", out var fileIdRaw) &&
+            fileIdRaw is not null)
+        {
+            requirement.ResourceId = fileIdRaw.ToString();
+        }
+
+        // check if the user is authorized
+        if (await securityHandler.IsAuthorized(context.User, requirement))
         {
             context.Succeed(requirement);
         }
diff --git a/src/WopiHost.Core/Security/Authorization/WopiAuthorizeAttribute.cs b/src/WopiHost.Core/Security/Authorization/WopiAuthorizeAttribute.cs
new file mode 100644
index 00000000..e083bbc7
--- /dev/null
+++ b/src/WopiHost.Core/Security/Authorization/WopiAuthorizeAttribute.cs
@@ -0,0 +1,42 @@
+using Microsoft.AspNetCore.Authorization;
+using WopiHost.Abstractions;
+
+namespace WopiHost.Core.Security.Authorization;
+
+/// <summary>
+/// Represents an authorization requirement for a given combination of resource, user, and action.
+/// </summary>
+/// <remarks>
+/// Creates an instance of <see cref="WopiAuthorizeAttribute"/> initialized with <paramref name="permission"/>.
+/// </remarks>
+/// <param name="permission">Permissions required for a given combination of resource, user, and action.</param>
+/// <param name="resourceType">type of the resource.</param>
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
+public class WopiAuthorizeAttribute(
+    Permission permission,
+    WopiResourceType resourceType) : AuthorizeAttribute, IWopiAuthorizationRequirement,  IAuthorizationRequirement, IAuthorizationRequirementData
+{
+    /// <summary>
+    /// Gets a permissions required for a given combination of resource, user, and action.
+    /// </summary>
+    public Permission Permission { get; } = permission;
+
+    /// <summary>
+    /// Gets the type of the resource.
+    /// </summary>
+    public WopiResourceType ResourceType { get; } = resourceType;
+
+    /// <summary>
+    /// Gets or sets the identifier of the resource.
+    /// </summary>
+    public string? ResourceId { get; set; }
+    
+    /// <summary>
+    /// Gets the requirements.
+    /// </summary>
+    /// <returns></returns>
+    public IEnumerable<IAuthorizationRequirement> GetRequirements()
+    {
+        yield return this;
+    }
+}
\ No newline at end of file
diff --git a/src/WopiHost.Core/Security/FileResource.cs b/src/WopiHost.Core/Security/FileResource.cs
deleted file mode 100644
index 14969032..00000000
--- a/src/WopiHost.Core/Security/FileResource.cs
+++ /dev/null
@@ -1,16 +0,0 @@
-namespace WopiHost.Core.Security;
-
-/// <summary>
-/// Represents a resource for a resource-based authroization.
-/// </summary>
-/// <remarks>
-/// Creates an object representing a resource for a resource-based authroization.
-/// </remarks>
-/// <param name="fileId">Identifier of a resource.</param>
-public class FileResource(string fileId)
-{
-    /// <summary>
-    /// Identifier of a resource.
-    /// </summary>
-    public string FileId { get; } = fileId;
-}
diff --git a/src/WopiHost.Core/Security/WopiOperations.cs b/src/WopiHost.Core/Security/WopiOperations.cs
deleted file mode 100644
index 40f933d2..00000000
--- a/src/WopiHost.Core/Security/WopiOperations.cs
+++ /dev/null
@@ -1,29 +0,0 @@
-using WopiHost.Abstractions;
-
-namespace WopiHost.Core.Security;
-
-/// <summary>
-/// Operations to be used with resource-based authorization.
-/// </summary>
-public static class WopiOperations
-{
-    /// <summary>
-    /// Given operation requires the user to have a create file permission.
-    /// </summary>
-    public static readonly WopiAuthorizationRequirement Create = new(Permission.Create);
-
-    /// <summary>
-    /// Given operation requires the user to have a read file permission.
-    /// </summary>
-    public static readonly WopiAuthorizationRequirement Read = new(Permission.Read);
-
-    /// <summary>
-    /// Given operation requires the user to have a update file permission.
-    /// </summary>
-    public static readonly WopiAuthorizationRequirement Update = new(Permission.Update);
-
-    /// <summary>
-    /// Given operation requires the user to have a delete file permission.
-    /// </summary>
-    public static readonly WopiAuthorizationRequirement Delete = new(Permission.Delete);
-}
\ No newline at end of file
diff --git a/src/WopiHost.FileSystemProvider/WopiFileSystemProvider.cs b/src/WopiHost.FileSystemProvider/WopiFileSystemProvider.cs
index f0020ceb..36867e35 100644
--- a/src/WopiHost.FileSystemProvider/WopiFileSystemProvider.cs
+++ b/src/WopiHost.FileSystemProvider/WopiFileSystemProvider.cs
@@ -1,5 +1,4 @@
-using System.Security.Claims;
-using System.Text;
+using System.Text;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Hosting;
 using WopiHost.Abstractions;
@@ -42,7 +41,7 @@ public WopiFileSystemProvider(IHostEnvironment env, IConfiguration configuration
         FileSystemProviderOptions = configuration.GetSection(WopiConfigurationSections.STORAGE_OPTIONS)?
             .Get<WopiFileSystemProviderOptions>() ?? throw new ArgumentNullException(nameof(configuration));
     }
-    
+
     /// <inheritdoc/>
     public IWopiFile GetWopiFile(string identifier)
     {
diff --git a/src/WopiHost.FileSystemProvider/WopiSecurityHandler.cs b/src/WopiHost.FileSystemProvider/WopiSecurityHandler.cs
index 6cc05abf..e35a7cc1 100644
--- a/src/WopiHost.FileSystemProvider/WopiSecurityHandler.cs
+++ b/src/WopiHost.FileSystemProvider/WopiSecurityHandler.cs
@@ -104,7 +104,7 @@ public Task<SecurityToken> GenerateAccessToken(string userId, string resourceId,
     }
 
     /// <inheritdoc/>
-    public Task<bool> IsAuthorized(ClaimsPrincipal principal, string resourceId, WopiAuthorizationRequirement operation, CancellationToken cancellationToken = default)
+    public Task<bool> IsAuthorized(ClaimsPrincipal principal, IWopiAuthorizationRequirement requirement, CancellationToken cancellationToken = default)
     {
         return Task.FromResult(principal.Identity?.IsAuthenticated == true);
     }
diff --git a/src/WopiHost/Startup.cs b/src/WopiHost/Startup.cs
deleted file mode 100644
index 3a4374a4..00000000
--- a/src/WopiHost/Startup.cs
+++ /dev/null
@@ -1,119 +0,0 @@
-using WopiHost.Abstractions;
-using WopiHost.Core.Models;
-using Serilog;
-using WopiHost.Core.Extensions;
-using WopiHost.Core.Infrastructure;
-
-namespace WopiHost;
-
-public class Startup(IConfiguration configuration)
-{
-    /// <summary>
-    /// Sets up the DI container.
-    /// </summary>
-    public void ConfigureServices(IServiceCollection services)
-    {
-        services.AddLogging(loggingBuilder =>
-        {
-            loggingBuilder.AddConsole(); //Configuration.GetSection("Logging")
-            loggingBuilder.AddDebug();
-        });
-
-        // Configuration
-        // this makes sure that the configuration exists and is valid
-        var wopiHostOptionsSection = configuration.GetRequiredSection(WopiConfigurationSections.WOPI_ROOT);
-        services
-            .AddOptionsWithValidateOnStart<WopiHostOptions>()
-            .BindConfiguration(wopiHostOptionsSection.Path) 
-            .ValidateDataAnnotations();
-
-        var wopiHostOptions = wopiHostOptionsSection.Get<WopiHostOptions>();
-        // Add file provider
-        services.AddStorageProvider(wopiHostOptions.StorageProviderAssemblyName);
-        // Add lock provider
-        services.AddLockProvider(wopiHostOptions.LockProviderAssemblyName);
-        // Add Cobalt support
-        if (wopiHostOptions.UseCobalt)
-        {
-            // Add cobalt
-            services.AddCobalt();
-        }
-
-        services.AddControllers();
-
-        // Add WOPI
-        services.AddWopi(o =>
-        {
-            o.OnCheckFileInfo = GetWopiCheckFileInfo;
-        });
-    }
-
-    /// <summary>
-    /// Configure is called after ConfigureServices is called.
-    /// </summary>
-    public static void Configure(IApplicationBuilder app, IWebHostEnvironment env)
-    {
-        if (env.IsDevelopment())
-        {
-            app.UseDeveloperExceptionPage();
-        }
-
-        app.UseSerilogRequestLogging(options =>
-        {
-            options.EnrichDiagnosticContext = LogHelper.EnrichWithWopiDiagnostics;
-            options.MessageTemplate = "HTTP {RequestMethod} {RequestPath} with [WOPI CorrelationID: {" + nameof(WopiHeaders.CORRELATION_ID) + "}, WOPI SessionID: {" + nameof(WopiHeaders.SESSION_ID) + "}] responded {StatusCode} in {Elapsed:0.0000} ms";
-        });
-
-        app.UseRouting();
-
-        // Automatically authenticate
-        app.UseAuthentication();
-        app.UseAuthorization();
-
-        app.UseEndpoints(endpoints =>
-        {
-            endpoints.MapControllers();
-            endpoints.MapGet("/", () => "This is just a WOPI server. You need a WOPI client to access it...").ShortCircuit(404);
-        });
-    }
-
-    /// <summary>
-    /// Custom handling of CheckFileInfo results for WOPI-Validator
-    /// </summary>
-    /// <param name="context"></param>
-    /// <returns></returns>
-    private static Task<WopiCheckFileInfo> GetWopiCheckFileInfo(WopiCheckFileInfoContext context)
-    {
-        var wopiCheckFileInfo = context.CheckFileInfo;
-        wopiCheckFileInfo.AllowAdditionalMicrosoftServices = true;
-        wopiCheckFileInfo.AllowErrorReportPrompt = true;
-
-        // ##183 required for WOPI-Validator
-        if (wopiCheckFileInfo.BaseFileName == "test.wopitest")
-        {
-            wopiCheckFileInfo.CloseUrl = new("https://example.com/close");
-            wopiCheckFileInfo.DownloadUrl = new("https://example.com/download");
-            wopiCheckFileInfo.FileSharingUrl = new("https://example.com/share");
-            wopiCheckFileInfo.FileUrl = new("https://example.com/file");
-            wopiCheckFileInfo.FileVersionUrl = new("https://example.com/version");
-            wopiCheckFileInfo.HostEditUrl = new("https://example.com/edit");
-            wopiCheckFileInfo.HostEmbeddedViewUrl = new("https://example.com/embedded");
-            wopiCheckFileInfo.HostEmbeddedEditUrl = new("https://example.com/embeddededit");
-            wopiCheckFileInfo.HostRestUrl = new("https://example.com/rest");
-            wopiCheckFileInfo.HostViewUrl = new("https://example.com/view");
-            wopiCheckFileInfo.SignInUrl = new("https://example.com/signin");
-            wopiCheckFileInfo.SignoutUrl = new("https://example.com/signout");
-
-            wopiCheckFileInfo.ClientUrl = new("https://example.com/client");
-            wopiCheckFileInfo.FileEmbedCommandUrl = new("https://example.com/embed");
-
-            // https://learn.microsoft.com/microsoft-365/cloud-storage-partner-program/rest/files/checkfileinfo/checkfileinfo-other#breadcrumb-properties
-            wopiCheckFileInfo.BreadcrumbBrandName = "WopiHost";
-            wopiCheckFileInfo.BreadcrumbBrandUrl = new("https://example.com");
-            wopiCheckFileInfo.BreadcrumbDocName = "test";
-            wopiCheckFileInfo.BreadcrumbFolderName = "root";
-            wopiCheckFileInfo.BreadcrumbFolderUrl = new("https://example.com/folder");
-        }
-        return Task.FromResult(wopiCheckFileInfo);
-    }
-}
diff --git a/test/WopiHost.Core.Tests/Controllers/FilesControllerTests.cs b/test/WopiHost.Core.Tests/Controllers/FilesControllerTests.cs
index 3133fbab..6ea2f518 100644
--- a/test/WopiHost.Core.Tests/Controllers/FilesControllerTests.cs
+++ b/test/WopiHost.Core.Tests/Controllers/FilesControllerTests.cs
@@ -2,7 +2,6 @@
 using System.Net.Mime;
 using System.Security.Claims;
 using System.Text.Json;
-using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
@@ -20,7 +19,6 @@ public class FilesControllerTests
     private readonly Mock<IWopiStorageProvider> storageProviderMock;
     private readonly Mock<IWopiSecurityHandler> securityHandlerMock;
     private readonly Mock<IOptions<WopiHostOptions>> wopiHostOptionsMock;
-    private readonly Mock<IAuthorizationService> authorizationServiceMock;
     private readonly Mock<IWopiLockProvider> lockProviderMock;
     private FilesController controller;
 
@@ -37,14 +35,12 @@ public FilesControllerTests()
                 LockProviderAssemblyName = "test",
                 OnCheckFileInfo = o => Task.FromResult(o.CheckFileInfo)
             });
-        authorizationServiceMock = new Mock<IAuthorizationService>();
         lockProviderMock = new Mock<IWopiLockProvider>();
 
         controller = new FilesController(
             storageProviderMock.Object,
             securityHandlerMock.Object,
             wopiHostOptionsMock.Object,
-            authorizationServiceMock.Object,
             lockProviderMock.Object)
         {
             ControllerContext = new ControllerContext
@@ -54,30 +50,11 @@ public FilesControllerTests()
         };
     }
 
-    [Fact]
-    public async Task GetCheckFileInfo_Unauthorized_ReturnsUnauthorized()
-    {
-        // Arrange
-        var fileId = "testFileId";
-        authorizationServiceMock
-            .Setup(a => a.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), It.IsAny<IEnumerable<IAuthorizationRequirement>>()))
-            .ReturnsAsync(AuthorizationResult.Failed());
-
-        // Act
-        var result = await controller.GetCheckFileInfo(fileId);
-
-        // Assert
-        Assert.IsType<UnauthorizedResult>(result);
-    }
-
     [Fact]
     public async Task GetCheckFileInfo_FileNotFound_ReturnsNotFound()
     {
         // Arrange
         var fileId = "testFileId";
-        authorizationServiceMock
-            .Setup(a => a.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), It.IsAny<IEnumerable<IAuthorizationRequirement>>()))
-            .ReturnsAsync(AuthorizationResult.Success());
         storageProviderMock.Setup(s => s.GetWopiFile(fileId)).Returns<IWopiFile>(null!);
 
         // Act
@@ -101,9 +78,6 @@ public async Task GetCheckFileInfo_Success_ReturnsFileInfoForAnonymous()
         fileMock.SetupGet(f => f.Length).Returns(1024);
         fileMock.Setup(f => f.GetReadStream(It.IsAny<CancellationToken>())).ReturnsAsync(new System.IO.MemoryStream());
 
-        authorizationServiceMock
-            .Setup(a => a.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), It.IsAny<IEnumerable<IAuthorizationRequirement>>()))
-            .ReturnsAsync(AuthorizationResult.Success());
         storageProviderMock
             .Setup(s => s.GetWopiFile(fileId))
             .Returns(fileMock.Object);
@@ -145,9 +119,6 @@ public async Task GetCheckFileInfo_Success_ReturnsFileInfoWithAuthenticatedUser(
         fileMock.SetupGet(f => f.Length).Returns(1024);
         fileMock.Setup(f => f.GetReadStream(It.IsAny<CancellationToken>())).ReturnsAsync(new System.IO.MemoryStream());
 
-        authorizationServiceMock
-            .Setup(a => a.AuthorizeAsync(It.IsAny<ClaimsPrincipal>(), It.IsAny<object>(), It.IsAny<IEnumerable<IAuthorizationRequirement>>()))
-            .ReturnsAsync(AuthorizationResult.Success());
         storageProviderMock
             .Setup(s => s.GetWopiFile(fileId))
             .Returns(fileMock.Object);
@@ -193,7 +164,6 @@ public void ProcessLock_LockingNotSupported_ReturnsLockMismatchResult()
             storageProviderMock.Object,
             securityHandlerMock.Object,
             wopiHostOptionsMock.Object,
-            authorizationServiceMock.Object,
             null,
             null)
         {
diff --git a/test/WopiHost.Core.Tests/Security/Authentication/AccessTokenHandlerTests.cs b/test/WopiHost.Core.Tests/Security/Authentication/AccessTokenHandlerTests.cs
index 59022821..464b4e09 100644
--- a/test/WopiHost.Core.Tests/Security/Authentication/AccessTokenHandlerTests.cs
+++ b/test/WopiHost.Core.Tests/Security/Authentication/AccessTokenHandlerTests.cs
@@ -43,6 +43,26 @@ public AccessTokenHandlerTests()
         );
     }
 
+    [Fact]
+    public async Task HandleAuthenticateAsync_ShouldReturnNoResult_WhenNotWopiPath()
+    {
+        // Arrange
+        var context = new DefaultHttpContext()
+        {
+            Request =
+            {
+                Path = "/whatever",
+            }
+        };
+        await _accessTokenHandler.InitializeAsync(scheme, context);
+
+        // Act
+        var result = await _accessTokenHandler.AuthenticateAsync();
+
+        // Assert
+        Assert.True(result.None);
+    }
+
     [Fact]
     public async Task HandleAuthenticateAsync_ShouldReturnSuccess_WhenTokenIsValid()
     {
@@ -56,6 +76,7 @@ public async Task HandleAuthenticateAsync_ShouldReturnSuccess_WhenTokenIsValid()
         {
             Request =
             {
+                Path = "/wopi",
                 Query = new QueryCollection(new Dictionary<string, StringValues>
                 {
                     { AccessTokenDefaults.ACCESS_TOKEN_QUERY_NAME, token }
diff --git a/test/WopiHost.Core.Tests/Security/Authorization/WopiAuthorizationHandlerTests.cs b/test/WopiHost.Core.Tests/Security/Authorization/WopiAuthorizationHandlerTests.cs
new file mode 100644
index 00000000..1497e5c6
--- /dev/null
+++ b/test/WopiHost.Core.Tests/Security/Authorization/WopiAuthorizationHandlerTests.cs
@@ -0,0 +1,95 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Moq;
+using WopiHost.Abstractions;
+using WopiHost.Core.Security.Authorization;
+
+namespace WopiHost.Core.Tests.Security.Authorization;
+
+public class WopiAuthorizationHandlerTests
+{
+    private readonly Mock<IWopiSecurityHandler> _mockSecurityHandler;
+    private readonly WopiAuthorizationHandler _handler;
+    private readonly WopiAuthorizeAttribute _requirement;
+
+    public WopiAuthorizationHandlerTests()
+    {
+        _mockSecurityHandler = new Mock<IWopiSecurityHandler>();
+        _handler = new WopiAuthorizationHandler(_mockSecurityHandler.Object);
+        _requirement = new WopiAuthorizeAttribute(Permission.Read, WopiResourceType.File);
+    }
+
+    [Fact]
+    public async Task HandleRequirementAsync_ShouldSucceed_WhenUserIsAuthorized()
+    {
+        // Arrange
+        var httpContext = new DefaultHttpContext();
+        httpContext.Request.RouteValues["id"] = "fileId";
+        var context = new AuthorizationHandlerContext([_requirement], new ClaimsPrincipal(), httpContext);
+        _mockSecurityHandler
+            .Setup(s => s.IsAuthorized(It.IsAny<ClaimsPrincipal>(), _requirement, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(true);
+
+        // Act
+        await _handler.HandleAsync(context);
+
+        // Assert
+        Assert.True(context.HasSucceeded);
+    }
+
+    [Fact]
+    public async Task HandleRequirementAsync_ShouldFail_WhenUserIsNotAuthorized()
+    {
+        // Arrange
+        var httpContext = new DefaultHttpContext();
+        httpContext.Request.RouteValues["id"] = "fileId";
+        var context = new AuthorizationHandlerContext([_requirement], new ClaimsPrincipal(), httpContext);
+        _mockSecurityHandler
+            .Setup(s => s.IsAuthorized(It.IsAny<ClaimsPrincipal>(), _requirement, It.IsAny<CancellationToken>()))
+            .ReturnsAsync(false);
+
+        // Act
+        await _handler.HandleAsync(context);
+
+        // Assert
+        Assert.False(context.HasSucceeded);
+    }
+
+    [Fact]
+    public async Task HandleRequirementAsync_ShouldSetResourceId_WhenRouteValueExists()
+    {
+        // Arrange
+        var httpContext = new DefaultHttpContext();
+        httpContext.Request.RouteValues["id"] = "fileId";
+        var context = new AuthorizationHandlerContext([_requirement], new ClaimsPrincipal(), httpContext);
+        _mockSecurityHandler
+            .Setup(s => s.IsAuthorized(It.IsAny<ClaimsPrincipal>(), _requirement, It.IsAny<CancellationToken>()))
+            .Callback<ClaimsPrincipal, IWopiAuthorizationRequirement, CancellationToken>((p, r, c) => Assert.Equal("fileId", r.ResourceId))
+            .ReturnsAsync(true);
+
+        // Act
+        await _handler.HandleAsync(context);
+
+        // Assert
+        Assert.True(context.HasSucceeded);
+    }
+
+    [Fact]
+    public async Task HandleRequirementAsync_ShouldNotSetResourceId_WhenRouteValueDoesNotExist()
+    {
+        // Arrange
+        var httpContext = new DefaultHttpContext();
+        var context = new AuthorizationHandlerContext([_requirement], new ClaimsPrincipal(), httpContext);
+        _mockSecurityHandler
+            .Setup(s => s.IsAuthorized(It.IsAny<ClaimsPrincipal>(), _requirement, It.IsAny<CancellationToken>()))
+            .Callback<ClaimsPrincipal, IWopiAuthorizationRequirement, CancellationToken>((p, r, c) => Assert.Null(r.ResourceId))
+            .ReturnsAsync(false);
+
+        // Act
+        await _handler.HandleAsync(context);
+
+        // Assert
+        Assert.False(context.HasSucceeded);
+    }
+}
diff --git a/test/WopiHost.Core.Tests/WopiHost.Core.Tests.csproj b/test/WopiHost.Core.Tests/WopiHost.Core.Tests.csproj
index 12e0ef18..869a7661 100644
--- a/test/WopiHost.Core.Tests/WopiHost.Core.Tests.csproj
+++ b/test/WopiHost.Core.Tests/WopiHost.Core.Tests.csproj
@@ -9,6 +9,7 @@
 	  <Folder Include="Controllers\" />
 	  <Folder Include="Infrastructure\" />
 	  <Folder Include="Security\Authentication\" />
+	  <Folder Include="Security\Authorization\" />
 	</ItemGroup>
 	<ItemGroup>
 	  <PackageReference Include="Moq" />