ASP.NET Core Web API Interview Question #52

What is authorization in ASP.NET Core Web API?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Authorization determines whether an authenticated or anonymous caller is allowed to access a resource or perform an operation. ASP.NET Core supports role-based, claims-based, policy-based, and resource-based authorization.

Detailed Explanation

Authorization rules must be enforced on the server. Hiding an API action in a client application does not protect the endpoint.

Code Example

[Authorize(Roles = "Admin")]
[HttpDelete("{id:int}")]
public IActionResult Delete(int id)
{
    return NoContent();
}