ASP.NET Core MVC Interview Question #103

What is the difference between authentication and authorization?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

Authentication answers 'Who is the user?' while authorization answers 'What is this user allowed to do?'. Authentication normally happens first so authorization can evaluate the resulting identity and claims.

Detailed Explanation

A user can be successfully authenticated but still receive an access-denied response because the user does not satisfy the authorization policy for a resource.

Code Example

[Authorize(Roles = "Admin")]
public IActionResult Users()
{
    return View();
}