codementor on Nostr: Learn: Authentication vs authorization Authentication: who are you? (login, a cookie, ...

Learn: Authentication vs authorization

Authentication: who are you? (login, a cookie, a token)
Authorization: what may you do? (roles, policies)
On a protected endpoint: no valid login → 401; logged in but not allowed → 403. (Cookie login redirects web pages to a login page; since .NET 10, API endpoints get 401/403.)

```csharp
var identity = new ClaimsIdentity(new[] { new Claim(ClaimTypes.Name, "ann"), new Claim(ClaimTypes.Role, "Admin") }, "demo");
var user = new ClaimsPrincipal(identity);
Console.WriteLine($"{user.Identity!.IsAuthenticated} {user.IsInRole("Admin")} {user.IsInRole("Billing")}");
```

It prints True True False. IsAuthenticated is true only because an authentication type ("demo") was given. ASP.NET Core builds this ClaimsPrincipal for every request (HttpContext.User).

Read more: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/

#tip · TIP-083