• What are Authorization Requirements and Handlers in ASP.NET Core's policy-based authorization? How do they work together?

  • Explain Policy-Based Authorization in ASP.NET Core . How does it offer more flexibility than Role-Based Authorization ? Provide an example of a custom policy .

  • What is Role-Based Authorization in ASP.NET Core ? How do you apply it using the [Authorize(Roles = "...")] attribute?

  • Explain the difference between Cookie-based authentication and Token-based (Bearer) authentication . Which is generally preferred for securing stateless ASP.NET Core Web APIs and why?

  • How can youcustomize or extend the IdentityUser and IdentityRole classesin ASP.NET Core Identity? Provide an example scenario.

  • What is ASP.NET Core Identity ? When would you choose it for managing users, authentication , and authorization within your application versus using an external provider like Azure AD ?

  • Explain the concept of Refresh Tokens . How would you implement a secure refresh token strategy for an ASP.NET Core Web API and its clients?

  • How do you handle token validation ( signature , issuer , audience , lifetime ) in an ASP.NET Core Web API receiving a JWT ?

  • What are the essential parts of a JWT , and what purpose does each part serve?

  • Describe how you would implement JWT (JSON Web Token) based authentication in an ASP.NET Core Web API . What packages and configuration are typically involved?Expertise Level: Mid-Level/Expert

  • Explain the difference between Authentication and Authorization in the context of ASP.NET Core Web API .