ASP.NET Core Web API Interview Question #63

What is policy-based authorization?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Policy-based authorization defines named authorization rules composed of requirements. Policies can check claims, roles, authentication schemes, custom requirements, or combinations of conditions.

Detailed Explanation

Policy-based authorization defines named authorization rules composed of requirements. Policies can check claims, roles, authentication schemes, custom requirements, or combinations of conditions.

Policies keep authorization intent centralized and reusable, making them preferable to repeating complex permission logic inside controller actions.

Code Example

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanPublish",
        policy => policy.RequireClaim(
            "permission", "products.publish"));
});

[Authorize(Policy = "CanPublish")]
[HttpPost("{id:int}/publish")]
public IActionResult Publish(int id) => NoContent();