Authentication & Authorization (Identity, JWT, OAuth)

app.UseAuthentication();  // establishes WHO the user is
app.UseAuthorization();   // decides WHAT they can access

[Authorize(Roles = "Admin")]
public IActionResult DeleteUser(int id) { ... }

Common follow-ups: What HTTP status codes correspond to failed authentication versus failed authorization?;How does ASP.NET Core represent an authenticated user internally?

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => {
        options.TokenValidationParameters = new TokenValidationParameters {
            ValidateIssuer = true,
            ValidIssuer = "myapp",
            ValidateAudience = true,
            ValidAudience = "myapp-api",
            IssuerSigningKey = new SymmetricSecurityKey(key)
        };
    });

Common follow-ups: Why is JWT considered stateless compared to cookie-based sessions?;How do you handle token revocation with stateless JWTs?

var claims = new[] {
    new Claim(JwtRegisteredClaimNames.Sub, user.Id),
    new Claim("tenant_id", user.TenantId),
    new Claim(ClaimTypes.Role, "Manager")
};
var token = new JwtSecurityToken(issuer, audience, claims,
    expires: DateTime.UtcNow.AddHours(1),
    signingCredentials: creds);

// Later, in any authorized endpoint:
var tenantId = User.FindFirst("tenant_id")?.Value;

Common follow-ups: What's the size trade-off of embedding many claims directly in a JWT?;How do you handle claims that change frequently (like roles) with long-lived tokens?

builder.Services.AddDefaultIdentity<IdentityUser>(options => {
    options.Password.RequireDigit = true;
    options.Password.RequiredLength = 8;
    options.SignIn.RequireConfirmedEmail = true;
}).AddEntityFrameworkStores<AppDbContext>();

Common follow-ups: How do you customize the IdentityUser class to add custom profile fields?;How does Identity handle password hashing internally?

// Step 1: Redirect user to authorization server
// GET https://auth.example.com/authorize?client_id=...&response_type=code&redirect_uri=...

// Step 2: User authenticates, redirected back with a code
// GET https://myapp.com/callback?code=abc123

// Step 3: Server exchanges code for tokens (back-channel, not visible to browser)
// POST https://auth.example.com/token  { code: 'abc123', client_secret: '...' }

Common follow-ups: What is PKCE and why is it required for public clients (SPAs, mobile apps)?;What's the difference between an authorization code and an access token?

[Authorize(Roles = "Admin")]
[HttpDelete("{id}")]
public IActionResult DeleteUser(int id) {
    _userService.Delete(id);
    return NoContent();
}

// Multiple roles (OR logic): [Authorize(Roles = "Admin,Manager")]

Common follow-ups: How would you require a user to have ALL of multiple roles instead of ANY?;How does role-based authorization compare to claims-based or policy-based authorization?

builder.Services.AddAuthorization(options => {
    options.AddPolicy("MinimumAge", policy =>
        policy.RequireAssertion(context =>
            context.User.HasClaim(c => c.Type == "age" && int.Parse(c.Value) >= 18)));
});

[Authorize(Policy = "MinimumAge")]
public IActionResult ViewRestrictedContent() { ... }

Common follow-ups: How do you implement resource-based authorization where the specific object being accessed matters?;What's the difference between RequireAssertion and a custom IAuthorizationHandler class?

// Client uses access token normally until it expires
// Then exchanges the refresh token for a new pair:
POST /auth/refresh
{ "refreshToken": "long-lived-opaque-token" }

// Response:
{ "accessToken": "new-short-lived-jwt", "refreshToken": "new-refresh-token" }

Common follow-ups: How do you securely store refresh tokens on different client types (web, mobile)?;What is refresh token rotation and why does it improve security?

// Denylist approach: check jti against a fast cache (e.g., Redis) on each request
var jti = User.FindFirst(JwtRegisteredClaimNames.Jti)?.Value;
if (await _revokedTokenCache.ExistsAsync(jti)) {
    return Results.Unauthorized();
}

Common follow-ups: What's the performance cost of checking a denylist on every request?;How do short-lived tokens plus refresh revocation compare to a full denylist approach?

POST https://auth.example.com/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=service-a&client_secret=***&scope=api.read

Common follow-ups: Why shouldn't client secrets ever be embedded in browser-based or mobile client code?;How does scope limiting reduce the blast radius of a compromised service credential?