C# Interview Question #170

What is the difference between authentication and authorization?

ASP.NET Core, DI & Middleware Senior Advanced

Quick Interview Answer

Authentication determines who the user is. Authorization determines what an authenticated or anonymous user is allowed to do.

Detailed Explanation

Authentication determines who the user is. Authorization determines what an authenticated or anonymous user is allowed to do.

ASP.NET Core authentication can use cookies, JWT bearer tokens, OpenID Connect, Identity, or other schemes.

Authorization can use roles, claims, policies, and custom requirements. A production application should avoid scattering manual permission checks throughout business code when policies or centralized authorization rules can express them more consistently.

Code Example

[Authorize]
public class AccountController : Controller
{
}

[Authorize(Roles = "Admin")]
public IActionResult AdminOnly()
{
    return View();
}