ASP.NET Core Interview Question #149

What is the principle of least privilege in an ASP.NET Core application?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Least privilege means users, application identities, database accounts, services, and infrastructure components receive only the permissions required to perform their intended tasks.

Detailed Explanation

Least privilege means users, application identities, database accounts, services, and infrastructure components receive only the permissions required to perform their intended tasks.

For example, ordinary users should not receive administrative roles, an application database login should not automatically be a server administrator, and an API token should have only the scopes required by that client.

Least privilege reduces the impact of compromised accounts, programming errors, and leaked credentials.

Code Example

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ManageUsers", policy =>
        policy.RequireClaim("permission", "users.manage"));
});

[Authorize(Policy = "ManageUsers")]
public IActionResult ManageUsers() => View();