ASP.NET Core Interview Question #128

What is the difference between authentication and authorization?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Authentication answers “Who are you?” while authorization answers “What are you allowed to do?” Authentication establishes an identity; authorization evaluates access rules for that identity.

Detailed Explanation

Authentication answers “Who are you?” while authorization answers “What are you allowed to do?” Authentication establishes an identity; authorization evaluates access rules for that identity.

A user may be successfully authenticated but still receive a 403 Forbidden response when authorization requirements are not satisfied. An unauthenticated user attempting to access a protected endpoint commonly receives a challenge, such as a redirect to login for cookie authentication or a 401 response for an API.

Code Example

app.UseAuthentication();   // Establish identity
app.UseAuthorization();    // Evaluate access

[Authorize(Policy = "CanManageProducts")]
public IActionResult Manage() => View();