ASP.NET Core MVC Interview Question #104

What does the [Authorize] attribute do?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Authorize requires the current request to satisfy the configured authorization rules. With no additional parameters, it normally requires an authenticated user.

Detailed Explanation

Authorize requires the current request to satisfy the configured authorization rules. With no additional parameters, it normally requires an authenticated user.

The attribute can be placed on a controller to protect all of its actions or on individual actions for narrower scope. It can also reference roles or named policies.

Code Example

[Authorize]
public class OrdersController : Controller
{
    public IActionResult Index() => View();

    [Authorize(Policy = "CanRefundOrders")]
    public IActionResult Refund(int id) => View();
}