Interview Q&A

uthorization, Resource, Action, Exception, and Result filters.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

uthorization checks directly inside controllers. This led to:

• Repetition
• Hard-to-test classes
• Cross-cutting concerns polluting business logic
• Fragile code

Filters solve these by offering centralized, consistent, and reusable implementation points.

pp.UseMiddleware<YourMiddleware>();

pp.UseRouting();

pp.UseEndpoints(endpoints => { endpoints.MapControllers();

});

pp.Run();

• In older versions (e.g., .NET Core 3.1), Startup.cs is used:

public void Configure(IApplicationBuilder app,

IWebHostEnvironment env)

{

pp.UseMiddleware<YourMiddleware>();

pp.UseRouting();

pp.UseEndpoints(endpoints => {

endpoints.MapControllers(); });

}

• In ASP.NET Core 6+ (minimal hosting model), middleware is added in

Program.cs:

var builder = WebApplication.CreateBuilder(args);

var app = builder.Build();

app.UseMiddleware<YourMiddleware>();

app.UseRouting();

app.UseEndpoints(endpoints => { endpoints.MapControllers();

});

app.Run();

• In older versions (e.g., .NET Core 3.1), Startup.cs is used:

public void Configure(IApplicationBuilder app,

IWebHostEnvironment env)

app.UseMiddleware<YourMiddleware>();

app.UseRouting();

app.UseEndpoints(endpoints => {

endpoints.MapControllers(); });

Answer: Filters promote reusability, separation of concerns, cleaner controllers, and easier maintenance.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Answer: Example – Using ServiceFilter [ServiceFilter(typeof(AuditLogFilter))] public class UserController : ControllerBase { }

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

uthorization Before everything Identity, JWT, RBAC

Resource Before model binding Caching, request trimming

ction Before/after action Logging, validation

Exception On unhandled errors Global error handling

Result Before/after result Response wrapping,

formatting

Endpoint (ASP.NET Core

7+)

round minimal API

endpoints

Logging, validation

3.1 Authorization Filters

These execute first, determining whether the user can access the route.

Typical use cases:

• Restrict admin-only operations
• Validate JWT tokens
• Validate API keys

3.2 Resource Filters

Executed before model binding.

Perfect for:

• Caching
• Request size validation
• Global input sanitation

3.3 Action Filters

The most commonly used filter type.

Great for:

• Logging
• Auditing
• Validation rules
• Pre/post business logic wrappers

Example – Audit Logging Filter

public class AuditLogFilter : IActionFilter
{
private readonly ILogger<AuditLogFilter> _logger;
public AuditLogFilter(ILogger<AuditLogFilter> logger)
{
_logger = logger;
}
public void OnActionExecuting(ActionExecutingContext context)
{

_logger.LogInformation("Request started at: {time}",

DateTime.UtcNow);

}
public void OnActionExecuted(ActionExecutedContext context)
{

_logger.LogInformation("Request ended at: {time}",

DateTime.UtcNow);

}
}

3.4 Exception Filters

Centralizing error handling is vital in fintech and healthcare APIs.

Example use cases:

• Returning consistent error envelopes
• Logging unhandled exceptions
• Protecting internal stack traces

3.5 Result Filters

These wrap the response.

Use cases:

• Response compression
• Standardizing API responses
• Masking sensitive data

3.6 Endpoint Filters (ASP.NET Core 7+)

Primarily for minimal APIs.

Example use cases:

• Request validation
• Logging
• Caching
• Response transformation

pp.MapGet("/users/{id}", (int id) => GetUser(id))

.AddEndpointFilter(new LoggingEndpointFilter());

Answer: Authorization Filters Resource Filters Action Filters Exception Filters Result Filters Endpoint Filters (ASP.NET Core 7+)

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

pp.Map

Method Description

pp.Use Adds middleware that can call next in the

pipeline.

pp.UseMiddlewar

e<T>()

dds a custom middleware class.

pp.Run Terminal middleware – does not call next. Ends

the pipeline.

pp.Map Branches the pipeline based on URL path (e.g.

/api).

Example:

pp.Use(async (context, next) => {

wait next(); // go to next middleware

});

pp.Run(async context => {

wait context.Response.WriteAsync("Hello World"); //

terminates pipeline

});

Diagram)

• --------------------------

| Authorization Filter |

• --------------------------

• --------------------------

| Resource Filter |

• --------------------------

• --------------------------

| Model Binding Happens |

• --------------------------

• --------------------------

| Action Filter |

• --------------------------

• --------------------------

| Action Method |

• --------------------------

• --------------------------

| Result Filter |

• --------------------------

• --------------------------

| Response Returned |

• --------------------------

Answer: wait _next(context); // Post-processing logic } } Register it: pp.UseMiddleware&lt;MyCustomMiddleware&gt;();

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Create a class with:

• A constructor accepting RequestDelegate
• An Invoke or InvokeAsync method

public class MyCustomMiddleware

private readonly RequestDelegate _next;

public MyCustomMiddleware(RequestDelegate next) => _next =

next;

public async Task InvokeAsync(HttpContext context)

// Pre-processing logic

await _next(context);

// Post-processing logic

Register it:

app.UseMiddleware<MyCustomMiddleware>();

uthorization filters always run first. Intermediate Level

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Filters can be created using:

• Interfaces (IActionFilter, IAsyncActionFilter…)
• Attributes
• Dependency injection

Example – Custom Header Validation Filter

public class HeaderValidationFilter : IActionFilter
{
public void OnActionExecuting(ActionExecutingContext context)
{
if

(!context.HttpContext.Request.Headers.ContainsKey("X-Client-Id"))

{

context.Result = new BadRequestObjectResult("Missing

X-Client-Id header.");

}
}
public void OnActionExecuted(ActionExecutedContext context) { }
}

Answer: They run before model binding and after authorization. Perfect for caching or request trimming.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

✔ Use Filters When:

• You need information about controller or action context
• You need pre/post action execution access
• Logic must execute only on MVC actions

❌ Avoid Filters If:

• Logic applies to all HTTP requests → use middleware
• Heavy database operations are needed in every request

⚠ Pitfall: Filters run per action. Be mindful of expensive operations.

Answer: pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Middleware is executed in the order it's added, and this order affects

behavior.

Example:

app.UseAuthentication(); // Must come before authorization

app.UseAuthorization();

app.UseEndpoints(...);

Logging, error handling, and security middlewares must be early

in the pipeline.

Set context.Result = new BadRequestObjectResult(...).

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Concern Use Filter Use Middleware

Needs controller context ✔ ❌

Needs access before

routing

❌ ✔

Validating request body ❌ ✔

Logging per action ✔ ❌

Exception handling ✔ ✔

💡 Tip: If your logic is unrelated to MVC actions (e.g., CORS, compression),

middleware is the right choice.

wait next(); // only called if authenticated

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Answer: Simply don’t call await next() in a middleware: if (!context.User.Identity.IsAuthenticated) context.Response.StatusCode = 401; return; // Short-circuits await next(); // only called if authenticated

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Yes—via constructor injection, ServiceFilter, or TypeFilter.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

SP.NET Core filters support DI via:

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Answer: pp.UseStaticFiles() enables serving files from wwwroot. Important: It must be added before routing or endpoints so static files re served without invoking controller logic. pp.UseStaticFiles(); pp.UseRouting(); pp.UseEndpoints(...);

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.