ASP.NET Core Web API Interview Question #62

What is role-based authorization?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Role-based authorization grants access according to roles associated with the authenticated identity, such as Admin or Manager. ASP.NET Core can enforce role requirements through Authorize attributes or policies.

Detailed Explanation

Roles are useful for broad access categories, but fine-grained systems often benefit from permission or policy-based authorization instead of creating an excessive number of roles.

Code Example

[Authorize(Roles = "Admin,Manager")]
[HttpGet("reports")]
public IActionResult Reports()
{
    return Ok();
}