ASP.NET Core Authentication & Authorization 3

Question 1

Which handler class must be extended to implement a custom authorization requirement handler?

Accepted Answer

AuthorizationHandler<TRequirement>

Answer

Custom handlers inherit from AuthorizationHandler<TRequirement> and implement HandleRequirementAsync() to evaluate the requirement.

Question 2

What does context.Succeed(requirement) do inside an authorization handler?

Accepted Answer

Marks the requirement as successfully satisfied

Answer

Calling context.Succeed(requirement) signals to the authorization framework that this requirement has passed.

Question 3

Which OpenID Connect flow is recommended for server-side ASP.NET Core web applications?

Accepted Answer

Authorization Code Flow

Answer

Authorization Code Flow is the most secure flow for server-side apps, exchanging an authorization code for tokens on the back channel.

Question 4

What does [Authorize(Policy = "MinimumAge")] require in ASP.NET Core?

Accepted Answer

A named policy 'MinimumAge' to be registered with requirements in AddAuthorization()

Answer

Policy-based authorization evaluates the named policy's requirements, which must be registered during application startup.

Question 5

What is the purpose of refresh tokens in JWT authentication?

Accepted Answer

To obtain new access tokens without requiring re-authentication when the access token expires

Answer

Refresh tokens are long-lived credentials used to get new short-lived access tokens, avoiding frequent login prompts.

ASP.NET Core Practice Test