ASP.NET Core Web API Interview Question #59

What are claims in API authentication?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Claims are statements about an identity, such as a user identifier, name, role, tenant, or permission. After authentication, ASP.NET Core exposes claims through the current ClaimsPrincipal.

Detailed Explanation

Claims are statements about an identity, such as a user identifier, name, role, tenant, or permission. After authentication, ASP.NET Core exposes claims through the current ClaimsPrincipal.

Claims should be treated according to the trust established by the authentication scheme. The API should not trust arbitrary client-supplied headers merely because they contain values that look like claims.

Code Example

var userId = User.FindFirstValue(
    ClaimTypes.NameIdentifier);

var role = User.FindFirstValue(
    ClaimTypes.Role);