.NET Architecture & System Design Interview Question #152
What is authorization?
Security Architecture, Multi-Tenancy & Disaster Recovery Senior Advanced
Quick Interview Answer
Authorization determines what an authenticated identity is allowed to do. It is evaluated after identity is established and can depend on roles, claims, policies, resource ownership, tenant boundaries, or business rules.
Detailed Explanation
Authorization determines what an authenticated identity is allowed to do. It is evaluated after identity is established and can depend on roles, claims, policies, resource ownership, tenant boundaries, or business rules.
Authorization should be enforced on the server at every relevant trust boundary. Hiding a button in the UI is useful for user experience but is not a security control by itself.
Code Example
Authentication:
Who are you?
Authorization:
Can you perform
"ApproveOrder" on Order 42?