ASP.NET Core MVC Interview Question #111

What is policy-based authorization?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Policy-based authorization defines named authorization rules during application configuration. A policy can require authentication, claims, roles, custom requirements, or combinations of these rules.

Detailed Explanation

Policy-based authorization defines named authorization rules during application configuration. A policy can require authentication, claims, roles, custom requirements, or combinations of these rules.

Policies centralize authorization logic and give controllers meaningful names such as CanPublishContent instead of embedding permission details throughout the application.

Code Example

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanPublishContent", policy =>
        policy.RequireClaim("permission", "content.publish"));
});

[Authorize(Policy = "CanPublishContent")]
public IActionResult Publish(int id) => View();