How can I implement role-based access control in ASP.NET Core?

How can I implement role-based access control in ASP.NET Core?

To implement role-based access control in ASP.NET Core, you can use the built-in authorization features. First, define roles in your application, then use the [Authorize] attribute to restrict access to controllers or actions based on those roles.

Can you show me an example of defining roles?

Sure! You can define roles in your Startup.cs file using the AddAuthorization method. For example:

services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
});

What if I want to assign multiple roles to a user?

You can assign multiple roles to a user by using the UserManager class. For example:

await userManager.AddToRolesAsync(user, new[] { "Admin", "User" });

How do I check if a user is in a specific role?

You can check if a user is in a specific role using the User.IsInRole method in your controller or view:

if (User.IsInRole("Admin"))
{
    // Admin-specific logic
}