Interview Q&A

Short answer: Use JWT Bearer Tokens for stateless auth: services.AddAuthentication(JwtBearerDefaults.AuthenticationSch eme) .AddJwtBearer(options => { ... }); Secure endpoints with: [Authorize(Roles = "Admin")] OAuth supported via IdentityServer, Azure AD, or external providers.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: HTTPS: Enforced via UseHttpsRedirection() CORS: Limit origins using policies Anti-forgery: Usually not needed for APIs unless using cookies (use ValidateAntiForgeryToken) Use authentication + authorization checks for all endpoints

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: DTOs decouple internal models from API contracts. Use AutoMapper for mapping: CreateMap<Product, ProductDto>(); var dto = _mapper.Map<ProductDto>(product);

Example code

DTOs decouple internal models from API contracts. Use AutoMapper for mapping: CreateMap<Product, ProductDto>(); var dto = _mapper.Map<ProductDto>(product);

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Avoid breaking changes to existing endpoints. Use new versions for changes in contracts. Maintain old versions as long as needed. Ensure documentation and clients are updated accordingly.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Return 409 Conflict if concurrency exception is caught. Model Binding & Validation

Example code

Use RowVersion / ETag to detect concurrent edits. Example with EF Core: modelBuilder.Entity<Product>() .Property(p => p.RowVersion).IsRowVersion();

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SP.NET Core automatically binds data based on parameter types and attributes ([FromBody], [FromQuery], etc.).

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Model binding in ASP.NET Core maps incoming HTTP data to C# parameters or model properties. 🔍 Sources considered: Route data Query string Form data Headers JSON body (application/json) Uploaded files Services (via [FromServices]) ASP.NET Core automatically binds data based on parameter types and attributes ([FromBody], [FromQuery], etc.).

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Simple types (int, string, bool, DateTime, etc.): Bound from route, query string, or form fields. Complex types (custom classes): Bound from multiple sources like query/form fields or JSON body. public IActionResult Create([FromBody] Product product)

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use a custom model binder when default binding doesn’t work (e.g., custom formats, headers). public class CustomBinder : IModelBinder {

Example code

public Task BindModelAsync(ModelBindingContext context) { // Custom logic here }
} Register with [ModelBinder] or globally in Startup.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: [FromQuery], etc.) You cannot bind multiple [FromBody] parameters in a single action. Common sources: [FromBody] — for JSON/XML payloads [FromQuery] — query string [FromRoute] — route values [FromForm] — form fields and file uploads [FromHeader] — HTTP headers

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Decorate models with attributes: public class User { [Required] [StringLength(50)] [EmailAddress] public string Email { get; set; } } Used in both MVC and API for validation.

Example code

Decorate models with attributes: public class User { [Required] [StringLength(50)] [EmailAddress] public string Email { get; set; }
} Used in both MVC and API for validation.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Server-side: Always performed on the server; use ModelState.IsValid. Client-side: HTML5 + jQuery Unobtrusive Validation (for MVC/Razor Pages). Client-side validation improves UX, but server-side is essential for security.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Create custom rules by inheriting ValidationAttribute: public class MustBeEvenAttribute : ValidationAttribute { public override bool IsValid(object value) { return (int)value % 2 == 0; } } Use like: [MustBeEven] public int Number { get; set; }

Example code

Create custom rules by inheriting ValidationAttribute: public class MustBeEvenAttribute : ValidationAttribute {
public override bool IsValid(object value) {
return (int)value % 2 == 0;
}
} Use like: [MustBeEven] public int Number { get; set; }

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use for cross-field validation within a model: public class Product : IValidatableObject {

Example code

public string Name { get; set; }
public decimal Price { get; set; }
public IEnumerable<ValidationResult> Validate(ValidationContext context) { if (Price < 0) { yield return new ValidationResult("Price must be positive"); }
}
}

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Install FluentValidation.AspNetCore Create a validator class: public class UserValidator : AbstractValidator<User> {

Example code

public UserValidator() {
RuleFor(x => x.Email).NotEmpty().EmailAddress();
}
} Register with: services.AddFluentValidationAutoValidation(); ✅ Offers more readable and testable validation logic than data annotations.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: [ApiController] handles automatic validation: Returns 400 BadRequest with ValidationProblemDetails if ModelState.IsInvalid. In MVC (without [ApiController]), you need to manually check ModelState.IsValid. if (!ModelState.IsValid) return View(model);

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Used to check if bound model passed validation: if (!ModelState.IsValid) {

Example code

return BadRequest(ModelState);
} MVC automatically adds errors to ModelState based on validation attributes.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core supports binding nested properties: public class Order {

Example code

public Customer Customer { get; set; }
public List<Product> Products { get; set; }
} Works seamlessly from JSON or form data if property names match.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use [Required] for non-nullable fields. For optional values, use nullable types. Use ModelState to report and handle missing/invalid fields. Return custom error messages if needed.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Model binding does not sanitize input — it binds raw data. 🛡 To prevent attacks (XSS, injection), sanitize: Strings: HTML encode output (@Html.Encode) Manually clean input before use Use antivirus/malware scanners for uploaded files

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Used for file uploads from forms (not [FromBody]): public IActionResult Upload(IFormFile file)

Example code

{
var path = Path.Combine("uploads", file.FileName);
using var stream = new FileStream(path, FileMode.Create); file.CopyTo(stream); } 📝 For multiple files: List<IFormFile> files Configuration & AppSettings

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SPNETCORE_ENVIRONMENT=Development ✅ Loaded in order of precedence, where later files override earlier ones.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: appsettings.json: Base configuration file used across all environments. appsettings.{Environment}.json: Environment-specific overrides (e.g., Development, Production). 🔧 ASP.NET Core loads them automatically based on the environment: ASPNETCORE_ENVIRONMENT=Development ✅ Loaded in order of precedence, where later files override earlier ones.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SP.NET Core uses the ASPNETCORE_ENVIRONMENT variable to determine the runtime environment. Supported environments (by convention): Development Staging Production Environment-specific logic can be applied: if (env.IsDevelopment()) { ... } lso used to load: appsettings.{env}.json Startup{env}.cs (in older versions)

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Production) ASP.NET Core uses the ASPNETCORE_ENVIRONMENT variable to determine the runtime environment. Supported environments (by convention): Development Staging Production Environment-specific logic can be applied: if (env.IsDevelopment()) { ... } Also used to load: appsettings.{env}.json Startup{env}.cs (in older versions)

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.