ASP.NET Core MVC interview questions covering authentication, authorization, security & state management.
Open a question for the full answer, code and interview guidance.
Authentication determines who the current user is. ASP.NET Core authentication handlers examine credentials such as an authentication cookie or bearer token and, when valid, establish a ClaimsPrincipal on HttpContext.User.
Authorization determines whether an authenticated or anonymous user is allowed to access a resource or perform an operation. ASP.NET Core supports authorization through attributes, roles, claims, policies, requirements, and handlers.
Authentication answers 'Who is the user?' while authorization answers 'What is this user allowed to do?'. Authentication normally happens first so authorization can evaluate the resulting identity and claims.
Authorize requires the current request to satisfy the configured authorization rules. With no additional parameters, it normally requires an authenticated user.
AllowAnonymous marks an endpoint as not requiring authorization even when authorization is applied more broadly, such as at controller level.
Cookie authentication stores an encrypted authentication ticket in a browser cookie after sign-in. On later requests, the cookie authentication handler validates the cookie and reconstructs the user's ClaimsPrincipal.
After validating the user's credentials, create a ClaimsIdentity and ClaimsPrincipal and call SignInAsync with the configured authentication scheme. The authentication handler creates the protected cookie.
Signing out removes or invalidates the authentication session for the specified scheme. With cookie authentication, SignOutAsync causes the authentication cookie to be removed from the response.
A claim is a name-value statement about a user, such as a user identifier, email address, department, permission, or role. Claims are stored in one or more ClaimsIdentity objects within the current ClaimsPrincipal.
Role-based authorization allows access according to role membership, such as Admin, Editor, or Manager. The Authorize attribute can require one or more roles.
Policy-based authorization defines named authorization rules during application configuration. A policy can require authentication, claims, roles, custom requirements, or combinations of these rules.
An authorization requirement represents a condition that must be satisfied, while an authorization handler contains logic that evaluates the requirement against the current user and optional resource.
Resource-based authorization evaluates permission against a particular resource instance rather than only endpoint metadata. For example, a user may edit an article only if the user owns that article or has an elevated permission.
Challenge asks the configured authentication system to handle an unauthenticated request, which may redirect a cookie-authenticated browser to a login page. Forbid indicates that the user is authenticated but is not permitted to access the resource.
HTTPS encrypts HTTP traffic between the browser and server, protecting credentials, authentication cookies, anti-forgery tokens, form data, and page content from network interception and modification.
CSRF occurs when a malicious site causes a user's browser to submit an unwanted state-changing request to another site where the user is already authenticated. Cookie authentication is particularly relevant because browsers can automatically attach authentication cookies.
The application issues anti-forgery information to the client and expects the matching token information to be returned with a protected request. MVC validates the token before allowing the action to continue.
XSS occurs when untrusted content is rendered as executable HTML or JavaScript in another user's browser. Razor HTML-encodes ordinary string output by default, which significantly reduces the risk when displaying untrusted text.
An open redirect occurs when an application redirects to a user-controlled URL without verifying that the destination is safe. Attackers can use a trusted site's login or navigation flow to send users to a malicious external site.
Do not trust hidden fields, disabled-looking controls, query strings, or other client-submitted values as authoritative security data. Values such as owner IDs, prices, roles, or approval status should be obtained or verified on the server when they affect security or business integrity.
Session state stores per-user data across multiple HTTP requests using a session identifier, normally held in a cookie. The actual session data is stored by a configured server-side session provider.
Session persists data across multiple requests for a user until it expires or is removed. TempData is designed for short-lived data that survives a redirect and is typically consumed after it is read.
Cookies are small values stored by the browser and sent to the server according to their domain, path, expiration, SameSite, Secure, and other settings. They can support authentication, preferences, correlation, anti-forgery mechanisms, and other browser state.
ASP.NET Core Data Protection provides cryptographic APIs used by framework features and applications to protect data with encryption and integrity checks. Authentication cookies, TempData providers, and anti-forgery infrastructure rely on data-protection capabilities.
Use a proven authentication system such as ASP.NET Core Identity or correctly configured authentication handlers rather than building password and session security from scratch. Enforce authorization on controllers/actions or through policies, and use resource-based authorization when access depends on the specific record.