ASP.NET Core Web API Interview Question #65

What is resource-based authorization?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Resource-based authorization evaluates permission against a particular resource instance rather than only endpoint metadata. It is useful for rules such as “users may edit only records they own.”

Detailed Explanation

Resource-based authorization evaluates permission against a particular resource instance rather than only endpoint metadata. It is useful for rules such as “users may edit only records they own.”

The application normally loads the resource first and then calls IAuthorizationService with the current user, resource, and policy or requirement.

Code Example

var document = await _service.GetAsync(id, token);
if (document == null)
    return NotFound();

var result = await _authorization.AuthorizeAsync(
    User, document, "CanEditDocument");

if (!result.Succeeded)
    return Forbid();