ASP.NET Core Interview Question #235
How would you secure an ASP.NET Core admin area?
Senior ASP.NET Core Real-World Scenarios Senior Advanced
Quick Interview Answer
Require authentication and explicit authorization, preferably through a role or policy that represents administrative permission. Apply the requirement at the area/controller or endpoint boundary so new actions do not accidentally become public.
Detailed Explanation
Require authentication and explicit authorization, preferably through a role or policy that represents administrative permission. Apply the requirement at the area/controller or endpoint boundary so new actions do not accidentally become public.
Protect cookie-authenticated state-changing requests against CSRF, enforce HTTPS, configure secure cookies, use least privilege, and require stronger account controls appropriate to the risk. Sensitive administrative actions should be auditable.
Hiding the Admin link in the UI is not security; every server endpoint must enforce authorization independently.
Code Example
[Area("Admin")]
[Authorize(Policy = "AdminOnly")]
public class UsersController : Controller
{
public IActionResult Index() => View();
}