Interview Q&A

Short answer: ✅ ASP.NET Core supports hierarchical override of config sources: Environment variables override appsettings.json: MyApp__Logging__LogLevel__Default=Warning Command line arguments override everything: dotnet run --Logging:LogLevel:Default=Debug

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Inject IConfiguration anywhere: public class MyService {

Example code

private readonly string _apiKey;
public MyService(IConfiguration config) {
_apiKey = config["MySettings:ApiKey"];
}
} You can also access nested settings via config.GetSection("MySettings").

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Bind config to strongly typed objects: public class MySettings {

Example code

public string ApiKey { get; set; }
public int Timeout { get; set; }
} services.Configure<MySettings>(config.GetSection("MySettings")); Use via IOptions<MySettings>.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: IOptionsMonitor<T>) IOptions<T>: Reads settings once at startup. IOptionsSnapshot<T>: Gets updated settings per request (for scoped services). IOptionsMonitor<T>: Supports change notifications and works in singleton services. public MyService(IOptions<MySettings> options) {

Example code

var settings = options.Value;
}

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: User Secrets (for local dev): dotnet user-secrets init dotnet user-secrets set "MySettings:ApiKey" "secret" Azure Key Vault: builder.Configuration.AddAzureKeyVault(...); ✅ Secure sensitive data like API keys, connection strings, tokens.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: In appsettings.json: "Logging": { "LogLevel": { "Default": "Information", "Microsoft": "Warning", "Microsoft.Hosting.Lifetime": "Information" } } Supports built-in providers: Console, Debug, EventSource, Azure, etc. Custom configuration through ILogger<T>.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Stored under "ConnectionStrings" section in appsettings.json: "ConnectionStrings": { "DefaultConnection": "Server=.;Database=AppDb;Trusted_Connection=True;" } Read via: var conn = config.GetConnectionString("DefaultConnection"); Or inject via Options pattern.

Example code

Stored under "ConnectionStrings" section in appsettings.json: "ConnectionStrings": { "DefaultConnection": "Server=.;Database=AppDb;Trusted_Connection=True;"
} Read via: var conn = config.GetConnectionString("DefaultConnection"); Or inject via Options pattern.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: JSON files support live reload: builder.Configuration.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true); IOptionsMonitor<T> automatically updates bound values when config changes. 🔁 Does not work with all sources (e.g., env vars, command line).

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Using POCOs and Options pattern allows type-safe config: services.Configure<MySettings>(config.GetSection("MySettings")); Use [Required], [Range], etc., to add validation.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: You can validate bound config using IValidateOptions<T>: public class MySettingsValidator : IValidateOptions<MySettings> {

Example code

public ValidateOptionsResult Validate(string name, MySettings options) { if (string.IsNullOrWhiteSpace(options.ApiKey)) {
return ValidateOptionsResult.Fail("ApiKey is required."); }
return ValidateOptionsResult.Success;
}
} Register with DI: services.AddSingleton<IValidateOptions<MySettings>, MySettingsValidator>();

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core supports multiple configuration providers: JSON (default) Environment Variables Command Line Args INI files XML files In-memory Azure App Configuration Azure Key Vault Secrets Manager Each can be chained with priority.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use default values in POCOs or fallback logic: public class MySettings {

Example code

public string ApiKey { get; set; } = "default-api-key";
} Or: var apiKey = config["MySettings:ApiKey"] ?? "fallback";

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Default values and optional settings Use default values in POCOs or fallback logic: public class MySettings { public string ApiKey { get; set; } = "default-api-key"; } Or: var apiKey = config["MySettings:ApiKey"] ?

Explain a bit more

is a common interview topic in ASP.NET Core. Give a clear definition, then one concrete example. Default values and optional settings Use default values in POCOs or fallback logic: public class MySettings { public string ApiKey { get; set; } = "default-api-key"; } Or: var apiKey = config["MySettings:ApiKey"] ? is a common interview topic in ASP.NET Core. Give a clear definition, then one concrete example.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthentication &amp; Authorization (JWT, Identity) uthentication &amp; Authorization (JWT, Identity) uthentication &amp; Authorization (JWT, Identity) uthentication &amp; Authorization (JWT, Identity)

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ✅ Best practices: Don't log sensitive values Use [JsonIgnore] or remove values before logging Mask in logs manually: _logger.LogInformation("Token: {Token}", Mask(token)); Never store secrets in source-controlled files (appsettings.json) Use user-secrets, Key Vault, or environment variables instead Authentication & Authorization (JWT, Identity)

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core Identity provides a complete solution for: User registration & login Roles, claims, tokens Password hashing Two-factor authentication ✅ Setup: dotnet add package Microsoft.AspNetCore.Identity.EntityFrameworkCore In Startup or Program.cs: services.AddIdentity<IdentityUser, IdentityRole>() .AddEntityFrameworkStores<ApplicationDbContext>() .AddDefaultTokenProviders();

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: JWT (JSON Web Token) is a compact, URL-safe token format used for authentication.

Explain a bit more

✅ Configure JWT auth: services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidateAudience = true, ValidateLifetime = true, ValidateIssuerSigningKey = true, IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your-secret")) }; }); Use [Authorize] to secure endpoints.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ✅ Role-based: [Authorize(Roles = "Admin")] ✅ Policy-based: services.AddAuthorization(options => { options.AddPolicy("CanEdit", policy => policy.RequireClaim("EditPermission")); }); Then use: [Authorize(Policy = "CanEdit")] Policy-based gives more flexibility (custom requirements, claims, logic).

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Claims are user attributes (e.g., email, role, permissions). Add claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; Access in code: var claim = User.FindFirst("Permission")?.Value;

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: dd claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value; dd claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new… Claim("Permission", "Edit") }; ccess… in… code: var claim = User.FindFirst("Permission")?.Value; dd…

Explain a bit more

claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value; dd claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new… Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value;

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Using Claims Claims are user attributes (e.g., email, role, permissions).

Explain a bit more

Add claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; Access in code: var claim = User.FindFirst("Permission")? is a common interview topic in ASP.NET Core. Give a clear definition, then one concrete example. Using Claims Claims are user attributes (e.g., email, role, permissions). Add claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; Access in code: var claim = User.FindFirst("Permission")? is a common interview topic in ASP.NET Core. Give a clear definition, then one concrete example.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request. wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request. wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request. wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Used in traditional MVC apps for session-based auth. services.AddAuthentication(CookieAuthenticationDefaults.Authenticati onScheme) .AddCookie(options => { options.LoginPath = "/Account/Login"; }); On login: await HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: lso supports: Facebook Microsoft Twitter OpenID Connect Azure AD Use RemoteAuthenticationHandler<T> or Identity scaffolding.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use built-in providers: services.AddAuthentication() .AddGoogle(options => { options.ClientId = "..."; options.ClientSecret = "..."; }); Also supports: Facebook Microsoft Twitter OpenID Connect Azure AD Use RemoteAuthenticationHandler<T> or Identity scaffolding.

Example code

Use built-in providers: services.AddAuthentication() .AddGoogle(options => { options.ClientId = "...";
options.ClientSecret = "..."; }); Also supports: Facebook Microsoft Twitter OpenID Connect Azure AD Use RemoteAuthenticationHandler<T> or Identity scaffolding.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.