Interview Q&A

Short answer: Filters can be created using: Interfaces (IActionFilter, IAsyncActionFilter…) Attributes Dependency injection Example – Custom Header Validation Filter public class HeaderValidationFilter : IActionFilter

Example code

{
public void OnActionExecuting(ActionExecutingContext context)
{
if (!context.HttpContext.Request.Headers.ContainsKey("X-Client-Id")) { context.Result = new BadRequestObjectResult("Missing X-Client-Id header."); }
}
public void OnActionExecuted(ActionExecutedContext context) { }
}

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: They run before model binding and after authorization. Perfect for caching or request trimming.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ✔ Use Filters When: You need information about controller or action context You need pre/post action execution access Logic must execute only on MVC actions ❌ Avoid Filters If: Logic applies to all HTTP requests → use middleware Heavy database operations are needed in every request ⚠ Pitfall: Filters run per action. Be mindful of expensive operations.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Explain a bit more

pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline. pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Middleware is executed in the order it's added, and this order affects behavior.

Example code

app.UseAuthentication(); // Must come before authorization app.UseAuthorization(); app.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Set context.Result = new BadRequestObjectResult(...).

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Concern Use Filter Use Middleware Needs controller context ✔ ❌ Needs access before routing ❌ ✔ Validating request body ❌ ✔ Logging per action ✔ ❌ Exception handling ✔ ✔ 💡 Tip: If your logic is unrelated to MVC actions (e.g., CORS, compression), middleware is the right choice.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: wait next(); // only called if authenticated wait next(); // only called if authenticated wait next(); // only called if authenticated wait next(); // only called if authenticated

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Simply don’t call await next() in a middleware: if (!context.User.Identity.IsAuthenticated)

Example code

{
context.Response.StatusCode = 401;
return; // Short-circuits
}
await next(); // only called if authenticated

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Yes—via constructor injection, ServiceFilter, or TypeFilter.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SP.NET Core filters support DI via:

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: app.UseStaticFiles() enables serving files from wwwroot. Important: It must be added before routing or endpoints so static files are served without invoking controller logic. app.UseStaticFiles(); app.UseRouting(); app.UseEndpoints(...);

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Async filters implement IAsyncActionFilter and support await, improving scalability.

Example code

Async filters implement IAsyncActionFilter and support await, improving scalability.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: 🏦 Fintech API – Global Exception Filter Ensures consistent error envelopes across microservices. 🛠 Microservices – Audit Logging Tracks when sensitive controller actions are executed. 👮 Role-based Authorization Custom authorization filter validating role claims dynamically. 🚀 Performance Profiling Times how long each controller method takes. public class ProfilingFilter : IActionFilter

Example code

{
private Stopwatch _watch;
public void OnActionExecuting(ActionExecutingContext context)
{
_watch = Stopwatch.StartNew();
}
public void OnActionExecuted(ActionExecutedContext context)
{ _watch.Stop(); Console.WriteLine($"Action took {_watch.ElapsedMilliseconds} ms"); }
}

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: custom page or handler. if (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); }); custom page or handler.…

Example code

if… (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); }); custom page or handler. Example: if (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); }); custom page or handler.… Example: if (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); });

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: (UseExceptionHandler, UseDeveloperExceptionPage) UseDeveloperExceptionPage() shows detailed errors (development only). UseExceptionHandler("/Error") handles errors in production with a custom page or handler. Example: if (env.IsDevelopment()) app.UseDeveloperExceptionPage(); else app.UseExceptionHandler("/Error"); Or inline: app.UseExceptionHandler(errorApp => { errorApp.Run(async context => {

Example code

context.Response.StatusCode = 500;
await context.Response.WriteAsync("An error occurred"); }); });

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Yes. They form a pipeline based on their defined order.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters execute per controller action → use sparingly. Avoid heavy DB calls. Avoid creating new HttpClients or DbContexts inside filters. Prefer asynchronous filters.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing.

Explain a bit more

You can configure HTTPS ports in launchSettings.json or ppsettings.json. pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or ppsettings.json. pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or ppsettings.json. pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or ppsettings.json.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Redirects HTTP requests to HTTPS. app.UseHttpsRedirection(); Add early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or appsettings.json.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use: ActionExecutingContext mocks ActionExecutedContext mocks DefaultHttpContext var httpContext = new DefaultHttpContext(); var context = new ActionExecutingContext(...); Focus tests on: Expected results Short-circuiting behavior Context manipulation

Example code

Use: ActionExecutingContext mocks ActionExecutedContext mocks DefaultHttpContext var httpContext = new DefaultHttpContext();
var context = new ActionExecutingContext(...); Focus tests on: Expected results Short-circuiting behavior Context manipulation

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: app.UseStaticFiles(new StaticFileOptions { FileProvider = new PhysicalFileProvider(Path.Combine(env.ContentRootPath, "MyFiles")), RequestPath = "/Files", OnPrepareResponse = ctx => { ctx.Context.Response.Headers.Append("Cache-Control", "public,max-age=600"); } }); For directory browsing: app.UseDirectoryBrowser(new DirectoryBrowserOptions { FileProvider = new PhysicalFileProvider("path"), RequestPath = "/browse" });

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: When your logic depends on controller/action context, such as reading route values or action arguments.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Mistake Fix Doing authentication inside action filters Use authorization filters Performing heavy logic Move to middleware Not registering filters as services Use DI for maintainability Returning inconsistent error messages Handle errors via global exception filter

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.Run(async ctx => { wait ctx.Response.WriteAsync("This ends the pipeline"); }); pp.Run(async ctx => { wait ctx.Response.WriteAsync("This ends the pipeline"); }); pp.Run(async ctx => { wait ctx.Response.WriteAsync("This ends the pipeline"); }); pp.Run(async ctx => { wait ctx.Response.WriteAsync("This ends the pipeline"); });

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.