ASP.NET Core MVC Interview Question #112

What are authorization requirements and handlers?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

An authorization requirement represents a condition that must be satisfied, while an authorization handler contains logic that evaluates the requirement against the current user and optional resource.

Detailed Explanation

Custom requirements are useful when authorization cannot be expressed cleanly with simple roles or claims, such as checking whether the current user owns a record or satisfies a domain-specific permission rule.

Code Example

public sealed class MinimumAgeRequirement
    : IAuthorizationRequirement
{
    public int Age { get; }

    public MinimumAgeRequirement(int age)
        => Age = age;
}