Answer
Authentication identifies the user. Authorization decides what the user can access. ASP.NET Core uses modular auth handlers and policy-based authorization.
Quick Answer
Authentication answers "who are you?" — it validates the identity (cookie, JWT, API key) and populates HttpContext.User. Authorization answers "can you do this?" — it checks the authenticated user's claims against policies and requirements ([Authorize], [AllowAnonymous]). Authentication must run before Authorization in the pipeline.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ