All 16 Authentication & Authorization (Identity, JWT, OAuth) questions
More in Authentication & Authorization (Identity, JWT, OAuth)
What is the difference between authentication and authorization in ASP.NET Core? How does JWT (JSON Web Token) authentication work at a high level in ASP.NET Core? What is ASP.NET Core Identity, and what does it provide out of the box? How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow? What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? What are JWT claims, and how do you add custom claims when issuing a token? How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? How do you implement policy-based authorization for more complex, custom access rules beyond simple roles?
Advertisement
.NET › Authentication & Authorization (Identity, JWT, OAuth)

How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute?

Intermediate

Answer

Applying [Authorize(Roles = "Admin,Manager")] to a controller or action restricts access to only authenticated users whose ClaimsPrincipal contains a role claim matching any of the listed roles (comma-separated means OR logic), with the framework automatically returning 401 Unauthorized for unauthenticated requests or 403 Forbidden for authenticated-but-insufficiently-privileged ones.
[Authorize(Roles = "Admin")]
[HttpDelete("{id}")]
public IActionResult DeleteUser(int id) {
    _userService.Delete(id);
    return NoContent();
}

// Multiple roles (OR logic): [Authorize(Roles = "Admin,Manager")]
Real-world example An admin dashboard's user-deletion endpoint is restricted with [Authorize(Roles = "Admin")] so that even a fully authenticated regular user attempting to call the endpoint directly receives a 403 Forbidden.

Common follow-ups: How would you require a user to have ALL of multiple roles instead of ANY?;How does role-based authorization compare to claims-based or policy-based authorization?

Authentication & Authorization (Identity JWT OAuth);RESTful Web APIs & Controllers
All 16 Authentication & Authorization (Identity, JWT, OAuth) questions