# Authentication & Authorization (.NET) > JWT tokens, cookie authentication, Identity, authorization policies, claims, role-based access - 18 interview questions - Mid-Level - [Interview Questions: .NET](https://sharpskill.dev/en/technologies/dotnet/interview-questions.md) ## 1. What is a JWT (JSON Web Token)? **Answer** JWT is a self-contained token that encodes authentication information as digitally signed JSON. It consists of three parts separated by dots: header (algorithm), payload (data/claims), and signature (verification). Unlike server sessions, JWT is stateless and enables distributed authentication without server-side storage. ## 2. What is the fundamental difference between authentication and authorization? **Answer** Authentication verifies user identity (who is he), while authorization determines permissions (what can he do). Authentication is always the first step, followed by authorization. For example, logging in with a password is authentication, then checking if the user can access an admin resource is authorization. ## 3. How does cookie authentication work in ASP.NET Core? **Answer** The server generates an encrypted cookie after credential validation, automatically stored by the browser. This cookie contains user claims and is automatically sent with each request. The server decrypts the cookie to identify the user without database query. Suitable for traditional web applications with server-side navigation. ## 15 more questions available - What is the typical JWT authentication workflow in an API? - What is a claim in the authentication context? Sign up for free: https://sharpskill.dev/en/login ## Other .NET interview topics - [C# Basics](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-basics.md): 25 questions, Junior - [LINQ & Delegates](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-linq-delegates.md): 20 questions, Junior - [C# Language Essentials](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-language-essentials.md): 15 questions, Junior - [ASP.NET Core Fundamentals](https://sharpskill.dev/en/technologies/dotnet/interview-questions/aspnet-core-fundamentals.md): 18 questions, Junior - [ASP.NET Core Request Lifecycle](https://sharpskill.dev/en/technologies/dotnet/interview-questions/aspnet-core-request-lifecycle.md): 20 questions, Junior - [Configuration & Settings](https://sharpskill.dev/en/technologies/dotnet/interview-questions/configuration-settings.md): 20 questions, Junior - [Application Lifecycle](https://sharpskill.dev/en/technologies/dotnet/interview-questions/application-lifecycle.md): 20 questions, Junior - [Dependency Injection](https://sharpskill.dev/en/technologies/dotnet/interview-questions/dependency-injection.md): 24 questions, Mid-Level - [Entity Framework Core](https://sharpskill.dev/en/technologies/dotnet/interview-questions/entity-framework-core.md): 25 questions, Mid-Level - [Minimal APIs](https://sharpskill.dev/en/technologies/dotnet/interview-questions/minimal-apis.md): 18 questions, Mid-Level - [Web API Development](https://sharpskill.dev/en/technologies/dotnet/interview-questions/web-api-development.md): 22 questions, Mid-Level - [Async in ASP.NET Core](https://sharpskill.dev/en/technologies/dotnet/interview-questions/async-aspnet-core.md): 20 questions, Mid-Level - [HttpClient & Networking](https://sharpskill.dev/en/technologies/dotnet/interview-questions/httpclient-networking.md): 20 questions, Mid-Level - [JSON Serialization](https://sharpskill.dev/en/technologies/dotnet/interview-questions/json-serialization.md): 20 questions, Mid-Level - [Entity Framework Core Advanced](https://sharpskill.dev/en/technologies/dotnet/interview-questions/ef-core-advanced.md): 25 questions, Mid-Level - [C# Advanced Features](https://sharpskill.dev/en/technologies/dotnet/interview-questions/csharp-advanced-features.md): 20 questions, Mid-Level - [Clean Architecture](https://sharpskill.dev/en/technologies/dotnet/interview-questions/clean-architecture.md): 20 questions, Mid-Level - [Logging, Monitoring & Observability](https://sharpskill.dev/en/technologies/dotnet/interview-questions/logging-monitoring.md): 22 questions, Mid-Level - [Unit Testing & xUnit](https://sharpskill.dev/en/technologies/dotnet/interview-questions/unit-testing-xunit.md): 20 questions, Mid-Level - [Integration Testing](https://sharpskill.dev/en/technologies/dotnet/interview-questions/integration-testing.md): 18 questions, Mid-Level - [Docker & Containerization](https://sharpskill.dev/en/technologies/dotnet/interview-questions/docker-containerization.md): 16 questions, Mid-Level - [NuGet Package Management](https://sharpskill.dev/en/technologies/dotnet/interview-questions/nuget-package-management.md): 16 questions, Mid-Level - [Memory Management & GC](https://sharpskill.dev/en/technologies/dotnet/interview-questions/memory-management-gc.md): 22 questions, Senior - [Reactive Programming](https://sharpskill.dev/en/technologies/dotnet/interview-questions/reactive-programming.md): 24 questions, Senior - [Async/await & Patterns](https://sharpskill.dev/en/technologies/dotnet/interview-questions/async-await-patterns.md): 26 questions, Senior - [.NET Design Patterns](https://sharpskill.dev/en/technologies/dotnet/interview-questions/dotnet-design-patterns.md): 24 questions, Senior - [Performance Optimization](https://sharpskill.dev/en/technologies/dotnet/interview-questions/performance-optimization.md): 22 questions, Senior - [Security & Best Practices](https://sharpskill.dev/en/technologies/dotnet/interview-questions/security-best-practices.md): 24 questions, Senior - [SignalR & Real-time](https://sharpskill.dev/en/technologies/dotnet/interview-questions/signalr-realtime.md): 22 questions, Senior - [Microservices Architecture](https://sharpskill.dev/en/technologies/dotnet/interview-questions/microservices-architecture.md): 25 questions, Senior --- Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack. HTML version of this page: https://sharpskill.dev/en/technologies/dotnet/interview-questions/authentication-authorization