ASP.NET Core Interview Question #135

What is policy-based authorization?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Policy-based authorization defines named policies made up of one or more requirements. A policy can require authentication, roles, claims, assertions, or custom authorization requirements.

Detailed Explanation

Policy-based authorization defines named policies made up of one or more requirements. A policy can require authentication, roles, claims, assertions, or custom authorization requirements.

Policies centralize access rules and make endpoints easier to read. They are preferable to repeating complex security conditions inside controller actions.

Code Example

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanPublish", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.RequireClaim("permission", "publish");
    });
});

[Authorize(Policy = "CanPublish")]
public IActionResult Publish() => View();