ASP.NET Core MVC Interview Question #110

What is role-based authorization?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Role-based authorization allows access according to role membership, such as Admin, Editor, or Manager. The Authorize attribute can require one or more roles.

Detailed Explanation

Role-based authorization allows access according to role membership, such as Admin, Editor, or Manager. The Authorize attribute can require one or more roles.

Roles are convenient for broad categories of access, but fine-grained permissions often scale better with policies and claims rather than creating a large number of increasingly specific roles.

Code Example

[Authorize(Roles = "Admin,Manager")]
public IActionResult Reports()
{
    return View();
}