ASP.NET Core Authentication & Authorization 2 — Questions and Answers
Question 1: What is a claims-based identity in ASP.NET Core?
- An identity made up of key-value pairs (claims) representing user properties (Correct answer)
- An identity stored in a claims database
- An identity verified by a third-party claims authority only
- An identity with encrypted user data
Correct answer: An identity made up of key-value pairs (claims) representing user properties
Claims are name-value pairs attached to a ClaimsIdentity that represent facts about the user, such as name, email, or roles.
Question 2: What does the IAuthorizationService interface provide in ASP.NET Core?
- Programmatic authorization checks against policies or requirements (Correct answer)
- Service registration for auth middleware
- Token generation utilities
- User role management
Correct answer: Programmatic authorization checks against policies or requirements
IAuthorizationService.AuthorizeAsync() allows imperative authorization checks in services or controllers beyond attribute-based authorization.
Question 3: Which class is the base for custom authorization requirements in ASP.NET Core?
- IAuthorizationRequirement (Correct answer)
- AuthorizationRequirementBase
- PolicyRequirement
- ClaimsRequirement
Correct answer: IAuthorizationRequirement
IAuthorizationRequirement is a marker interface implemented by requirement classes used in custom authorization policies.
Question 4: What is an authorization policy in ASP.NET Core?
- A named set of requirements that must all be met for access to be granted (Correct answer)
- A role definition stored in the database
- A middleware component for authentication
- A configuration file for access rules
Correct answer: A named set of requirements that must all be met for access to be granted
Policies combine one or more IAuthorizationRequirement objects and are registered by name using AddAuthorization().
Question 5: How do you configure cookie authentication in ASP.NET Core?
- services.AddAuthentication().AddCookie() (Correct answer)
- services.UseCookies()
- services.AddCookieAuth()
- app.UseCookieAuthentication()
Correct answer: services.AddAuthentication().AddCookie()
AddAuthentication() registers the auth framework and AddCookie() configures the cookie authentication handler with its options.
Question 6: What is the purpose of the ClaimsPrincipal in ASP.NET Core?
- It represents the current user, holding one or more ClaimsIdentity objects (Correct answer)
- It is the database principal for user management
- It holds the principal configuration for policies
- It enforces claims validation on every request
Correct answer: It represents the current user, holding one or more ClaimsIdentity objects
ClaimsPrincipal is the container for the user's identities and is available via HttpContext.User throughout a request.
ASP.NET Core Authentication & Authorization 2
What is a claims-based identity in ASP.NET Core?