Junior ASP.NET Web API Interview Questions

Authentication verifies user identity in Web API.

Common implementations:

• JWT Bearer Tokens – stateless authentication for SPA and mobile apps.
• OAuth2 / OpenID Connect – external identity providers.
• Cookie authentication – mainly for browser-based apps.

Configured using AddAuthentication() and UseAuthentication().

JWT workflow:

• User logs in ? server generates a signed JWT.
• Client sends token in Authorization: Bearer <token>.
• Server validates signature and extracts claims.
• No server-side session required.

Use role-based authorization with:

[Authorize(Roles="Admin,Manager")]

Roles are validated from claims inside the JWT or identity provider.

Claims-based authorization checks user claims instead of static roles.

Implemented using policy-based authorization:

services.AddAuthorization(options =>
{
    options.AddPolicy("HRPolicy",
        policy => policy.RequireClaim("Department", "HR"));
});

Create policies in Program.cs using AddAuthorization.

Apply using [Authorize(Policy="PolicyName")].

Useful for domain-specific access control.

Authentication: Verifies user identity.

Authorization: Determines what the authenticated user can access.

Secure endpoints using:

• [Authorize] attribute
• HTTPS enforcement
• Input validation
• Rate limiting
• CORS restrictions

JWT includes an exp claim for expiration.

API rejects expired tokens automatically.

Refresh tokens extend the session securely.

API best practices:

• Use JWT instead of cookies
• Enable strict CORS policies
• Use anti-forgery tokens if cookies are used

Best practices:

• Store in Key Vault or environment variables
• Never hard-code keys
• Rotate keys periodically

OAuth2 is a secure authorization framework.

Flow: Client ? Auth Server ? Access Token ? API.

Supports scopes, roles, and claims.

Roles: Broad user categories.

Scopes: Fine-grained permissions such as read:orders.

Token revocation strategies:

• Blacklist tokens in database
• Short-lived access tokens
• Rotating refresh tokens

Multi-tenant API security includes:

• Tenant ID in claims or headers
• Middleware-based access validation
• Database filtering by tenant context

Use DTOs instead of binding directly to entity models.

Expose only allowed fields.

Always validate incoming payloads.

• Force HTTPS
• Use [Authorize]
• Limit payload size
• Use secure headers
• Validate all inputs
• Implement logging & monitoring

Best practices:

• Store refresh tokens securely
• Use rotating refresh tokens
• Issue short-lived access tokens
• Revoke tokens on suspicious activity

Use HttpContext methods:

• User.IsInRole("Admin")
• User.Claims to inspect claim values

Add claims during token creation (email, role, custom fields).

Validate claims in controllers or authorization policies.

Audit using structured logs including:

• User identity
• Action invoked
• Timestamp
• IP address
• Request and response metadata

Essential for compliance and threat detection.