Capgemini .NET Client Round Question: Why Your JWT Auth Fails: 401 vs 403 Interview Breakdown

In this Capgemini .NET CSharp(C#) client-round interview question, I explain how a C# and ASP.NET Core Web API validates JWT authentication and protects an Admin endpoint. If you’re preparing for a .NET full-stack interview, follow the Angular-to-API request flow and the questions an interviewer may ask about JWT signing, authorization, and 401 versus 403. The scenario: an Angular application sends a JWT with every request. Only users with Admin privileges should access a protected endpoint. How would you explain the solution clearly—and handle the follow-ups without losing your train of thought? ⏱️ CHAPTERS 00:00 Why the client round feels different 00:47 The Capgemini question: secure an Admin API with JWT 01:35 How I break down a scenario before answering 05:08 What a JWT actually does 06:45 “Stateless” authentication: what does the server remember? 07:39 JWT versus sessions: why use a token? 09:52 Scalability benefits—and the trade-offs to mention 12:25 What’s inside a JWT: header, payload, signature 15:11 How is a JWT signature created? 19:12 Symmetric versus asymmetric signing 22:35 Follow the JWT from login to the protected API 24:21 Why middleware order matters in ASP.NET Core 25:03 How an Admin endpoint is protected 26:40 401 versus 403: which failure happened? 27:18 Valid JWT, but still 403? Check the role claim 29:19 Role-based versus permission-based authorization 30:04 What we’ll build in the hands-on follow-up 🎯 IN THIS VIDEO • How to structure an answer to a scenario-based .NET client-round question • JWT structure, signing, and validation concepts • Stateless authentication and JWT versus sessions • The request flow from an Angular client to an ASP.NET Core Web API • Authentication and authorization middleware • Admin endpoint policies and role claims • Why a valid token can still fail an authorization check • The difference between 401 Unauthorized and 403 Forbidden This episode focuses on explaining the interview scenario and the architecture behind it. The hands-on Angular and ASP.NET Core implementation is planned for a separate video. If you’ve faced a JWT authentication or authorization question in an interview, share the follow-up that challenged you most in the comments. Subscribe to DotNet Decode for more C#, .NET, ASP.NET Core, and full-stack interview discussions.