ASP.NET Core Interview Question #134

What is claims-based authorization?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Claims-based authorization evaluates claims contained in the user's ClaimsPrincipal. Instead of asking only whether a user belongs to a role, a policy can require a particular claim or claim value.

Detailed Explanation

Claims-based authorization evaluates claims contained in the user's ClaimsPrincipal. Instead of asking only whether a user belongs to a role, a policy can require a particular claim or claim value.

This works well for attributes such as department, account type, verified status, or application permissions. Claims should represent trustworthy identity or authorization data and should be refreshed when security-sensitive values change.

Code Example

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ITOnly", policy =>
        policy.RequireClaim("department", "IT"));
});

[Authorize(Policy = "ITOnly")]
public IActionResult Dashboard() => View();