Chapter 7

1. What attribute can we use to mark a method or controller so that it can only be called through HTTPS?

[RequireHttps].

2. What is the difference between role-based and policy-based authorization?

Policy-based authorization is more powerful; it can use both roles or any other custom requirement that you can think of.

3. What is the purpose of CORS?

CORS is a mechanism by which servers can tell the browsers to bypass their normal security restrictions and allow the loading of static resources (normally scripts) from different sources (servers).

4. What is the purpose of HSTS?

It is a web policy for telling the browsers that they should only interact with a server through HTTPS. It is specified in RFC 6797.

5. What is the challenge...