Interview Q&A

• Configure CORS policy on the server.
• Allow specific origins, headers, and methods.

👉 Example in ASP.NET Core:

services.AddCors(options =>

{

options.AddPolicy("MyPolicy",

builder => builder.WithOrigins("

.AllowAnyHeader()

.AllowAnyMethod());

});

• Apply with app.UseCors("MyPolicy");.

Answer: Idempotent = multiple identical requests have the same effect as one request. Important for reliability and safe retries. HTTP Methods: GET, PUT, DELETE → Idempotent. POST → Not idempotent (creates new resource each time).

What interviewers expect

• A clear definition tied to REST API in ASP.NET Web API projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Web API application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Web API architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

• 2xx Success → 200 (OK), 201 (Created).
• 4xx Client Errors → 400 (Bad Request), 401 (Unauthorized), 404 (Not Found).
• 5xx Server Errors → 500 (Internal Server Error), 503 (Service Unavailable).
• Error responses should include structured messages:

{

"status": 400,

"error": "Invalid Data",

"details": "Email is required"

}

• Horizontal scaling → Add more servers/containers.
• Load balancing across multiple instances.
• Database optimization (indexes, partitioning, read replicas).
• Caching at server, client, and CDN levels.
• Use asynchronous processing for long-running tasks.
• Apply rate limiting and throttling to prevent abuse.
• Adopt microservices architecture for modular scaling.

• Use a load balancer (NGINX, HAProxy, AWS ELB, Azure Front Door).
• Distribute traffic across multiple instances to avoid bottlenecks.
• Support round-robin, least connections, or IP hash strategies.
• Enable health checks to route traffic only to healthy instances.
• Combine with auto-scaling for dynamic traffic management.

• Reduce payload size (use JSON instead of XML, compress responses).
• Implement pagination for large datasets.
• Apply caching at multiple levels.
• Use async I/O (non-blocking calls).
• Minimize database calls (batch queries, stored procedures).
• Enable GZIP compression on responses.
• Profile and monitor using APM tools (New Relic, Application Insights).

• Client-side caching → Reduces server calls, but may serve stale data.
• Server-side caching → Faster responses, but increases memory usage.
• Proxy caching/CDN → Global scalability, but harder cache invalidation.
• Database caching (Redis) → Faster queries, but adds complexity and consistency

issues.

REST API?

• Add query parameters:
• Filtering: /products?category=shoes&brand=nike
• Sorting: /products?sort=price_asc
• Searching: /products?search=wireless+headphones
• Use LINQ/SQL queries in backend.
• Ensure query optimization with indexes.
• Implement validation to prevent SQL injection.

• Add query parameters:
• Filtering: /products?category=shoes&brand=nike
• Sorting: /products?sort=price_asc
• Searching: /products?search=wireless+headphones
• Use LINQ/SQL queries in backend.
• Ensure query optimization with indexes.
• Implement validation to prevent SQL injection.

• Deploy servers closer to users (geo-distributed hosting).
• Use CDNs for static content.
• Apply connection pooling for databases.
• Reduce number of API calls (batching, GraphQL alternative).
• Use HTTP/2 or gRPC for faster communication.
• Monitor latency with APM tools and optimize bottlenecks.

• Swagger/OpenAPI → Standard for REST API design and documentation.
• Postman → Can generate collections and documentation automatically.
• Redoc → Static documentation from OpenAPI specs.
• RAML → RESTful API Modeling Language.
• Stoplight, Apiary, Docusaurus → Modern documentation and mocking platforms.

• In ASP.NET Core: Use Swashbuckle package to generate Swagger UI from

controllers and annotations.

services.AddSwaggerGen(c =>

{

c.SwaggerDoc("v1", new OpenApiInfo { Title = "My API", Version =

"v1" });

});

pp.UseSwagger();

pp.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json",

"My API v1"));

• Other frameworks (Node.js: swagger-jsdoc, Spring Boot: springdoc-openapi)

lso support annotations and automatic documentation.

• Implement global exception handling using middleware to catch unhandled

exceptions.

• Return consistent and meaningful error responses.
• Log errors for debugging and monitoring.

Example in ASP.NET Core:

pp.UseExceptionHandler(appError =>

{

ppError.Run(async context =>

{
context.Response.StatusCode = 500; // Internal Server Error
context.Response.ContentType = "application/json";
var contextFeature =

context.Features.Get<IExceptionHandlerFeature>();

if(contextFeature != null)
{

// Log exception (use ILogger)

wait context.Response.WriteAsync(new

{

StatusCode = context.Response.StatusCode,

Message = "Internal Server Error.",

Detail = contextFeature.Error.Message

}.ToString());

}

});

});

• 404 Not Found indicates the requested resource does not exist.
• Use it when a client requests an invalid ID or non-existent resource.
• Helps clients gracefully handle missing data.

Example in ASP.NET Core:

var user = dbContext.Users.Find(id);
if (user == null)
{
return NotFound(new { status = 404, error = "User not found" });
}

• Use model validation with data annotations.
• Return 400 Bad Request with a list of validation errors.

Example:

public class UserModel
{

[Required(ErrorMessage = "Email is required")]

[EmailAddress(ErrorMessage = "Invalid email format")]

public string Email { get; set; }

[Required]

[MinLength(6, ErrorMessage = "Password must be at least 6

characters")]

public string Password { get; set; }
}

// Controller action

[HttpPost("register")]

public IActionResult Register([FromBody] UserModel model)
{
if (!ModelState.IsValid)
{
var errors = ModelState.Values.SelectMany(v =>
v.Errors).Select(e => e.ErrorMessage);
return BadRequest(new { status = 400, error = "Validation
Failed", details = errors });
}
return Ok("User registered successfully");
}

PI?

• Structured logging with libraries like Serilog, NLog, or built-in ILogger.
• Log requests and responses, including headers and payloads (avoid sensitive info).
• Use correlation IDs to trace requests across services.
• Centralize logs using ELK Stack, Seq, or Azure Application Insights.
• Log different levels: Information, Warning, Error, Critical.

Example using ILogger in ASP.NET Core:

private readonly ILogger<MyController> _logger;
public MyController(ILogger<MyController> logger)
{
_logger = logger;
}

[HttpGet("{id}")]

public IActionResult GetUser(int id)
{

_logger.LogInformation("Fetching user with id {UserId}", id);

try

{
var user = dbContext.Users.Find(id);
if (user == null)
{

_logger.LogWarning("User with id {UserId} not found",

id);

return NotFound();
}
return Ok(user);
}

catch (Exception ex)

{

_logger.LogError(ex, "Error fetching user with id {UserId}",

id);

return StatusCode(500, "Internal Server Error");
}
}

This covers all core aspects of error handling and debugging for REST APIs.