ASP.NET Core Interview Question #132

What are claims?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

A claim is a name/value statement about an identity. Examples include a user ID, email address, department, role, subscription level, or application-specific permission.

Detailed Explanation

A claim is a name/value statement about an identity. Examples include a user ID, email address, department, role, subscription level, or application-specific permission.

Claims are useful because authorization can evaluate attributes of the current principal without tightly coupling access decisions to a particular user store. Claims received from external sources should be trusted only according to the security of the issuer and authentication process.

Code Example

var claims = new[]
{
    new Claim(ClaimTypes.NameIdentifier, user.Id),
    new Claim(ClaimTypes.Name, user.UserName),
    new Claim("department", "IT")
};

var identity = new ClaimsIdentity(claims, "AppCookie");