Now, only requests with a valid JWT in the Authorization: Bearer <token> header can access it. 󰰣 6. Explain role-based authorization.

Short answer: Role-based authorization restricts access based on user roles. ssign a role: wait _userManager.AddToRoleAsync(user, "Admin"); Use in controllers: [Authorize(Roles = "Admin")] public IActionResult Dashboard() => View(); You can also combine roles: [Authorize(Roles = "Admin,Manager")] 🧭 7. {

Example code

public int Age { get; }
public MinimumAgeRequirement(int age) => Age = age;
}
public class MinimumAgeHandler : uthorizationHandler<MinimumAgeRequirement> { protected override Task HandleRequirementAsync( uthorizationHandlerContext context, MinimumAgeRequirement requirement) {
var birthDateClaim = context.User.FindFirst(c => c.Type == "BirthDate"); if (birthDateClaim != null)
{
var birthDate = DateTime.Parse(birthDateClaim.Value);
if (birthDate.AddYears(requirement.Age) <= DateTime.Today) context.Succeed(requirement); }
return Task.CompletedTask;
}
} Register it: builder.Services.AddAuthorization(options => { options.AddPolicy("AdultOnly", policy => policy.Requirements.Add(new MinimumAgeRequirement(18))); }); builder.Services.AddSingleton<IAuthorizationHandler, MinimumAgeHandler>(); Use it: [Authorize(Policy = "AdultOnly")] public IActionResult BuyAlcohol() => Ok("Access granted"); 🍪 9. What is cookie authentication in ASP.NET Core? Cookie authentication stores user information in an encrypted cookie on the browser. When the user revisits, the cookie is used to identify them. Configure: builder.Services.AddAuthentication(CookieAuthenticationDefaults.Auth enticationScheme) .AddCookie(options => {
options.LoginPath = "/Account/Login";

Real-world example (ShopNest)

ShopNest admin screens use MVC: controller loads data, Razor view renders HTML, Tag Helpers build forms safely.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.