Interview Q&A

uthentication & Authorization (JWT, Identity)

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

✅ Best practices:

• Don't log sensitive values
• Use [JsonIgnore] or remove values before logging
• Mask in logs manually:

_logger.LogInformation("Token: {Token}", Mask(token));

• Never store secrets in source-controlled files (appsettings.json)
• Use user-secrets, Key Vault, or environment variables instead

Authentication & Authorization

(JWT, Identity)

SP.NET Core Identity provides a complete solution for:

• User registration & login
• Roles, claims, tokens
• Password hashing
• Two-factor authentication

✅ Setup:

dotnet add package Microsoft.AspNetCore.Identity.EntityFrameworkCore

In Startup or Program.cs:

services.AddIdentity<IdentityUser, IdentityRole>()

.AddEntityFrameworkStores<ApplicationDbContext>()

.AddDefaultTokenProviders();

JWT (JSON Web Token) is a compact, URL-safe token format used for authentication.

✅ Configure JWT auth:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)

.AddJwtBearer(options => {

options.TokenValidationParameters = new

TokenValidationParameters {

ValidateIssuer = true,

ValidateAudience = true,

ValidateLifetime = true,

ValidateIssuerSigningKey = true,

IssuerSigningKey = new

SymmetricSecurityKey(Encoding.UTF8.GetBytes("your-secret"))

};

});

Use [Authorize] to secure endpoints.

✅ Role-based:

[Authorize(Roles = "Admin")]

✅ Policy-based:

services.AddAuthorization(options => {

options.AddPolicy("CanEdit", policy =>

policy.RequireClaim("EditPermission"));

});

Then use:

[Authorize(Policy = "CanEdit")]

Policy-based gives more flexibility (custom requirements, claims, logic).

Answer: dd claims when creating identity: var claims = new List&lt;Claim&gt; { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value;

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

.Value;

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Answer: wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Used in traditional MVC apps for session-based auth.

services.AddAuthentication(CookieAuthenticationDefaults.Authenticati

onScheme)

.AddCookie(options => {

options.LoginPath = "/Account/Login";

});

On login:

await HttpContext.SignInAsync(principal);

Cookies are stored in the browser and sent with each request.

Answer: lso supports: Facebook Microsoft Twitter OpenID Connect Azure AD Use RemoteAuthenticationHandler&lt;T&gt; or Identity scaffolding.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Use built-in providers:

services.AddAuthentication()

.AddGoogle(options => {

options.ClientId = "...";

options.ClientSecret = "...";

});

Also supports:

• Facebook
• Microsoft
• Twitter
• OpenID Connect
• Azure AD

Use RemoteAuthenticationHandler<T> or Identity scaffolding.

Used with JWT to renew access tokens after expiration without logging in again.

• Issue refresh token along with access token.
• Store securely (DB or secure HTTP-only cookie).
• On access token expiration, send refresh token to get a new one.

You must manually implement refresh token logic (not built-in to Identity).

• JWTs typically expire in 5–30 minutes.
• Expired tokens cannot be used.
• Revocation requires token blacklisting (e.g., database of revoked tokens).

✅ Configure expiration:

Expires = DateTime.UtcNow.AddMinutes(30)

✅ Use refresh tokens to handle expiration.

Answer: [Authorize]: Requires authenticated user [Authorize(Roles = "Admin")]: Requires role [AllowAnonymous]: Allows access without login Example: [Authorize] public IActionResult Dashboard() { } [AllowAnonymous] public IActionResult Login() { }

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

Define complex authorization rules using IAuthorizationHandler:

public class MinimumAgeRequirement : IAuthorizationRequirement {

public int Age { get; }

public MinimumAgeRequirement(int age) => Age = age;

public class MinimumAgeHandler :

AuthorizationHandler<MinimumAgeRequirement> {

protected override Task HandleRequirementAsync(...) {

// logic

Register in DI and use with [Authorize(Policy = "...")].

SP.NET Core uses Data Protection API to:

• Encrypt authentication cookies
• Protect tokens (e.g., password reset tokens)

Configure:

services.AddDataProtection()

.PersistKeysToFileSystem(new DirectoryInfo("path"))

.SetApplicationName("AppName");

Used internally by Identity and cookie middleware.

Multi-tenancy can involve:

• Per-tenant databases
• Per-tenant user stores
• Per-tenant roles/policies

Strategies:

• Use claims to store tenant ID
• Filter data per tenant
• Custom middleware for tenant resolution

Can integrate with IdentityServer4 or Azure AD B2C for federated auth.

SP.NET Core Identity uses PBKDF2 hashing by default.

Best practices:

• Never store plaintext passwords
• Use salted + hashed storage
• Use PasswordHasher<T> or Identity defaults

Use:

PasswordHasher<T>.HashPassword(user, password)

Can switch to Argon2, Bcrypt via custom password hasher.

Supported out of the box in ASP.NET Core Identity.

Options:

• SMS (via provider)
• Email
• Authenticator app (TOTP)

Enable via Identity configuration:

services.Configure<IdentityOptions>(options => {

options.SignIn.RequireConfirmedEmail = true;

});

Use SignInManager<T> to handle verification and token generation.

Filters & Middleware Overlaps

Filters are components that run code before or after certain stages in the request pipeline

within MVC or Razor Pages. Types of filters include:

• Authorization filters: Run before any other filter to check user authorization.
• Resource filters: Run after authorization and before model binding.
• Action filters: Run before and after the execution of action methods.
• Exception filters: Handle unhandled exceptions thrown by actions.
• Result filters: Run before and after action results are executed.

Filters allow you to inject logic at these specific points.

• Middleware is part of the global HTTP request pipeline and executes for every

request.

• Filters only run within MVC/Razor pipeline, for controller actions or Razor Pages

handlers.

• Middleware runs earlier and can short-circuit the entire pipeline; filters run later,

scoped to MVC processing.

• Middleware is good for cross-cutting concerns affecting all requests, filters are better

for concerns around controller/action execution.

Create a custom filter by implementing one of the filter interfaces like:

public class CustomActionFilter : IActionFilter
{
public void OnActionExecuting(ActionExecutingContext context)
{

// Before action executes

}
public void OnActionExecuted(ActionExecutedContext context)
{

// After action executes

}
}

Register globally in Startup:

services.AddControllersWithViews(options =>

{

options.Filters.Add<CustomActionFilter>();

});

Or decorate controllers/actions:

[ServiceFilter(typeof(CustomActionFilter))]

public class HomeController : Controller { ... }

Answer: ctions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

What interviewers expect

• A clear definition tied to ASP.NET Core in ASP.NET Core projects
• Trade-offs (performance, maintainability, security, cost)
• When you would and would not use it in production

Real-world example

In a production ASP.NET Core application, teams apply this when handling user-facing features or integration boundaries. For example, you might use it during a sprint where reliability and observability matter—logging metrics, validating edge cases, and documenting the decision in an ADR so future developers understand why the approach was chosen.

How to explain in the interview

1. Define the concept in one or two sentences.
2. Context — where it fits in ASP.NET Core architecture.
3. Example — a specific project, bug, or performance win.
4. Trade-off — what you gain vs what you sacrifice.

Tip: Practice aloud on Toolliyo mock interview or the Interview Q&A section before your real interview.

• Global filters apply to all MVC actions, registered via AddControllers or AddMvc

options.

• Controller or action filters are applied via attributes directly on controllers or

actions.

• Global filters are best for cross-cutting concerns like logging, exception handling.
• Controller/action filters are best for behavior specific to particular routes or endpoints.

• Filter attributes are instantiated per request and support parameters, but have

limited DI capabilities.

• Service-based filters (using ServiceFilter or TypeFilter) allow filters to be

resolved from DI container, enabling constructor injection.

Use service-based filters when you need dependencies injected.