Role-Based Authorization

Role-based authorization is, perhaps, the best-known type of authorization. When it's applied to any endpoint, only the users assigned to any of the specified roles are allowed to access it. Otherwise, no access is given.

Role-based authorization and JWT

There is no strongly-defined standard of how user roles are defined in a JWT. However, a common way of sharing user roles is to have a role claim that is mapped to an array of individual role names in the JWT payload.

Here is an example of a JWT payload: