ASP.NET Core Authentication & Authorization

Question 1

Which attribute restricts access to authenticated users only in ASP.NET Core?

Accepted Answer

[Authorize]

Answer

[Authorize] applies the default authorization policy, denying access to unauthenticated users with a 401 or redirect.

Question 2

What does [AllowAnonymous] do when placed on an action inside an [Authorize] controller?

Accepted Answer

Overrides the controller-level authorization, allowing unauthenticated access to that action

Answer

[AllowAnonymous] takes precedence over any [Authorize] attributes, allowing the action to bypass authentication checks.

Question 3

Which middleware must be added before UseAuthorization() for authentication to work?

Accepted Answer

UseAuthentication()

Answer

UseAuthentication() must precede UseAuthorization() so that user identity is established before authorization policies are evaluated.

Question 4

What is the purpose of JWT Bearer authentication in ASP.NET Core APIs?

Accepted Answer

To validate tokens sent in the Authorization header and set the user identity

Answer

JWT Bearer middleware validates the signed JSON Web Token and populates HttpContext.User with claims from the token payload.

Question 5

Which method adds ASP.NET Core Identity to the application?

Accepted Answer

services.AddIdentity<TUser, TRole>()

Answer

AddIdentity<TUser, TRole>() registers Identity services including user management, password hashing, and role management.

ASP.NET Core Practice Test