ASP.NET Core Web API Interview Question #60

How does the [Authorize] attribute work in a Web API?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Authorize requires the request to satisfy the applicable authorization policy. With no additional parameters, it normally requires an authenticated user under the configured authorization rules.

Detailed Explanation

Authorize requires the request to satisfy the applicable authorization policy. With no additional parameters, it normally requires an authenticated user under the configured authorization rules.

It can be placed on a controller to protect all actions or on individual actions for more specific requirements.

Code Example

[Authorize]
[ApiController]
[Route("api/account")]
public class AccountController : ControllerBase
{
    [HttpGet("me")]
    public IActionResult Me() => Ok();
}