All 16 Authentication & Authorization (Identity, JWT, OAuth) questions
More in Authentication & Authorization (Identity, JWT, OAuth)
How does JWT (JSON Web Token) authentication work at a high level in ASP.NET Core? What is ASP.NET Core Identity, and what does it provide out of the box? How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute? How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow? What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? What are JWT claims, and how do you add custom claims when issuing a token? How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? How do you implement policy-based authorization for more complex, custom access rules beyond simple roles?
Advertisement
.NET › Authentication & Authorization (Identity, JWT, OAuth)

What is the difference between authentication and authorization in ASP.NET Core?

Beginner

Answer

Authentication answers 'who are you?' -- verifying a user's identity, typically producing a ClaimsPrincipal representing the authenticated user. Authorization answers 'what are you allowed to do?' -- deciding whether an authenticated (or even anonymous) user is permitted to access a specific resource or perform an action, evaluated after authentication has established identity.
app.UseAuthentication();  // establishes WHO the user is
app.UseAuthorization();   // decides WHAT they can access

[Authorize(Roles = "Admin")]
public IActionResult DeleteUser(int id) { ... }
Real-world example A request with a valid login token passes authentication (identity confirmed) but still receives a 403 Forbidden from authorization if that user lacks the Admin role required for a specific delete endpoint.

Common follow-ups: What HTTP status codes correspond to failed authentication versus failed authorization?;How does ASP.NET Core represent an authenticated user internally?

ASP.NET Core Middleware & Request Pipeline;RESTful Web APIs & Controllers
All 16 Authentication & Authorization (Identity, JWT, OAuth) questions