Authentication and Authorization in Web Forms, ASP.NET Core, and MVC CASENET Practice Questions (Page 9)

Questions 41–41

1. 41expert · hard

   An ASP.NET Core application uses JWT bearer authentication. The security team requires that the application enforce that a user's role cannot be changed during a session. However, the JWT contains a role claim that is used for authorization. What is the best way to handle this?

   • AUse a short token lifetime and rely on the role claim in the token; if a role changes, the user must re-authenticate.
   • BSet the JWT's 'role' claim to a constant value for all users.
   • CUse a custom authorization handler that reads the role from a cookie instead of the token.
   • DStore the role in a database and check it on every request.
   Reveal Solution Discussion Select an answer first