Authentication and authorization

Authentication verifies who the user is; authorization decides what they can do. ASP.NET Core supports cookies, JWT bearer tokens, OpenID Connect, and external providers (Google, Microsoft).

Cookie auth (MVC sites)

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie();
builder.Services.AddAuthorization();

Login creates encrypted cookie; subsequent requests include it automatically.

JWT (SPAs and mobile)

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => { /* Authority, Audience */ });

Clients send Authorization: Bearer <token>; stateless validation at each request.

Authorization

[Authorize(Roles = "Admin")]
[Authorize(Policy = "CanEditProducts")]

Policies combine claims, roles, and custom requirements in AddAuthorization.

Important interview questions and answers

1. Q: Cookie vs JWT?
   A: Cookies suit same-site MVC with CSRF protection; JWT suits cross-origin SPAs and mobile—often with refresh tokens.
2. Q: Authentication middleware order?
   A: UseAuthentication before UseAuthorization in the pipeline.
3. Q: [AllowAnonymous]?
   A: Opts out of [Authorize] on specific actions (login, health checks).

Self-check

1. Which header carries JWT tokens?
2. What attribute restricts an action to admins?

Pitfall: JWT in localStorage is XSS-sensitive—prefer httpOnly cookies for same-site apps or hardened SPA patterns with short-lived tokens and refresh rotation.