Interview Q&A

Short answer: Used with JWT to renew access tokens after expiration without logging in again. Issue refresh token along with access token. Store securely (DB or secure HTTP-only cookie). On access token expiration, send refresh token to get a new one. You must manually implement refresh token logic (not built-in to Identity).

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: JWTs typically expire in 5–30 minutes. Expired tokens cannot be used. Revocation requires token blacklisting (e.g., database of revoked tokens). ✅ Configure expiration: Expires = DateTime.UtcNow.AddMinutes(30) ✅ Use refresh tokens to handle expiration.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: [Authorize]: Requires authenticated user [Authorize(Roles = "Admin")]: Requires role [AllowAnonymous]: Allows access without login

Example code

[Authorize] public IActionResult Dashboard() { } [AllowAnonymous] public IActionResult Login() { }

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Define complex authorization rules using IAuthorizationHandler: public class MinimumAgeRequirement : IAuthorizationRequirement {

Example code

public int Age { get; }
public MinimumAgeRequirement(int age) => Age = age;
}
public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement> { protected override Task HandleRequirementAsync(...) { // logic }
} Register in DI and use with [Authorize(Policy = "...")].

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core uses Data Protection API to: Encrypt authentication cookies Protect tokens (e.g., password reset tokens) Configure: services.AddDataProtection() .PersistKeysToFileSystem(new DirectoryInfo("path")) .SetApplicationName("AppName"); Used internally by Identity and cookie middleware.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Multi-tenancy can involve: Per-tenant databases Per-tenant user stores Per-tenant roles/policies Strategies: Use claims to store tenant ID Filter data per tenant Custom middleware for tenant resolution Can integrate with IdentityServer4 or Azure AD B2C for federated auth.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core Identity uses PBKDF2 hashing by default. Best practices: Never store plaintext passwords Use salted + hashed storage Use PasswordHasher<T> or Identity defaults Use: PasswordHasher<T>.HashPassword(user, password) Can switch to Argon2, Bcrypt via custom password hasher.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Supported out of the box in ASP.NET Core Identity. Options: SMS (via provider) Email Authenticator app (TOTP) Enable via Identity configuration: services.Configure<IdentityOptions>(options => { options.SignIn.RequireConfirmedEmail = true; }); Use SignInManager<T> to handle verification and token generation. Filters & Middleware Overlaps

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters are components that run code before or after certain stages in the request pipeline within MVC or Razor Pages.

Explain a bit more

Types of filters include: Authorization filters: Run before any other filter to check user authorization. Resource filters: Run after authorization and before model binding. Action filters: Run before and after the execution of action methods. Exception filters: Handle unhandled exceptions thrown by actions. Result filters: Run before and after action results are executed. Filters allow you to inject logic at these specific points.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Middleware is part of the global HTTP request pipeline and executes for every request.

Explain a bit more

Filters only run within MVC/Razor pipeline, for controller actions or Razor Pages handlers. Middleware runs earlier and can short-circuit the entire pipeline; filters run later, scoped to MVC processing. Middleware is good for cross-cutting concerns affecting all requests, filters are better for concerns around controller/action execution.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Create a custom filter by implementing one of the filter interfaces like: public class CustomActionFilter : IActionFilter

Example code

{
public void OnActionExecuting(ActionExecutingContext context)
{ // Before action executes }
public void OnActionExecuted(ActionExecutedContext context)
{ // After action executes }
} Register globally in Startup: services.AddControllersWithViews(options => { options.Filters.Add<CustomActionFilter>(); }); Or decorate controllers/actions: [ServiceFilter(typeof(CustomActionFilter))] public class HomeController : Controller { ... }

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ctions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Global filters apply to all MVC actions, registered via AddControllers or AddMvc options. Controller or action filters are applied via attributes directly on controllers or actions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filter attributes are instantiated per request and support parameters, but have limited DI capabilities. Service-based filters (using ServiceFilter or TypeFilter) allow filters to be resolved from DI container, enabling constructor injection. Use service-based filters when you need dependencies injected.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthentication). Use filters for MVC-specific concerns tied to action execution (authorization, validation, caching). Filters can complement middleware for granular control within MVC. Example: Use middleware for global exception logging, filters for handling MVC-specific exceptions and returning appropriate views or API responses. Versioning,… CORS

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use middleware for concerns that affect all requests (logging, CORS, authentication). Use filters for MVC-specific concerns tied to action execution (authorization, validation, caching). Filters can complement middleware for granular control within MVC. Example: Use middleware for global exception logging, filters for handling MVC-specific exceptions and returning appropriate views or API responses. Versioning, CORS

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: API versioning enables multiple versions of your API to coexist, allowing clients to migrate gradually.

Explain a bit more

Common ways to version APIs in ASP.NET Core: URL versioning (e.g., /api/v1/products) Query string versioning (e.g., /api/products?api-version=1.0) Header versioning (custom header like api-version: 1.0) ● Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true;

Example code

options.DefaultApiVersion = new ApiVersion(1, 0);
options.ReportApiVersions = true; });

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: api-version=1.0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new ApiVersion(1, 0);……… api-version=1.

Explain a bit more

0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new ApiVersion(1, 0); options.ReportApiVersions = true; }); api-version=1.0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new…

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Semantic versioning (semver) uses MAJOR.MINOR.PATCH format, e.g., 1.2.0. MAJOR version changes break backward compatibility. MINOR versions add functionality in a backward-compatible manner. PATCH versions are for backward-compatible bug fixes. Version negotiation allows clients and servers to agree on an API version via headers or URL. Servers should support multiple versions and respond with supported version info.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Mark old versions as deprecated via documentation and HTTP response headers. Return warning headers or custom fields indicating version deprecation. Gradually phase out old versions, allowing clients to migrate. Consider introducing sunset policies and endpoints to notify clients.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin");

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Configure in Startup.cs or Program.cs: services.AddCors(options => { options.AddPolicy("AllowSpecificOrigin", builder => { builder.WithOrigins(" .AllowAnyHeader() .AllowAnyMethod(); }); }); Enable middleware: app.UseCors("AllowSpecificOrigin");

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: For certain CORS requests (e.g., methods other than GET/POST or custom headers), browsers send an OPTIONS request first, called a preflight. The server must respond with allowed methods, headers, and origins. Properly configured CORS policies handle preflight requests automatically.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Global CORS: Apply a policy for all endpoints by adding middleware early in the pipeline with app.UseCors(...). Per-endpoint CORS: Apply CORS policies selectively using the [EnableCors("PolicyName")] or [DisableCors] attributes on controllers or actions.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: To allow cookies or credentials in cross-origin requests, configure: builder.WithOrigins(" .AllowCredentials() .AllowAnyHeader() .AllowAnyMethod(); Clients must send requests with credentials: 'include'. Note: Allowing credentials disables the wildcard (*) origin.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.