ASP.NET Core MVC Interview Question #113

What is resource-based authorization?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Resource-based authorization evaluates permission against a particular resource instance rather than only endpoint metadata. For example, a user may edit an article only if the user owns that article or has an elevated permission.

Detailed Explanation

The controller normally loads the resource and calls IAuthorizationService.AuthorizeAsync with the user, resource, and policy or requirement. This is more precise than relying only on a route-level role check.

Code Example

var order = await _orders.GetAsync(id);

var result = await _authorizationService
    .AuthorizeAsync(User, order, "CanEditOrder");

if (!result.Succeeded)
    return Forbid();