ASP.NET Core Interview Question #133
What is role-based authorization?
Authentication, Authorization & Security Mid-Level Intermediate
Quick Interview Answer
Role-based authorization grants access according to roles assigned to the current user, such as Admin, Editor, or Manager. ASP.NET Core can enforce roles with the Authorize attribute or authorization policies.
Detailed Explanation
Role-based authorization grants access according to roles assigned to the current user, such as Admin, Editor, or Manager. ASP.NET Core can enforce roles with the Authorize attribute or authorization policies.
Roles are simple and useful when access naturally maps to organizational groups. For fine-grained permissions, policy- or claims-based authorization can be more expressive than creating many increasingly specific roles.
Code Example
[Authorize(Roles = "Admin")]
public IActionResult Users() => View();
[Authorize(Roles = "Admin,Editor")]
public IActionResult EditContent() => View();