ASP.NET Core MVC Interview Question #92
What is an authorization filter?
Advanced Routing, Filters, Areas & Application Structure Mid-Level Intermediate
Quick Interview Answer
An authorization filter runs early in the MVC filter pipeline and determines whether the current request is authorized to continue. In most applications, authorization should be expressed through ASP.NET Core authorization policies and the Authorize attribute rather than custom authorization-filter logic.
Detailed Explanation
An authorization filter runs early in the MVC filter pipeline and determines whether the current request is authorized to continue. In most applications, authorization should be expressed through ASP.NET Core authorization policies and the Authorize attribute rather than custom authorization-filter logic.
Authentication establishes identity, while authorization decides whether that identity may perform a particular operation.
Code Example
[Authorize(Policy = "CanManageProducts")]
public class ProductsController : Controller
{
public IActionResult Admin() => View();
}