Interview Q&A

Short answer: Filters can be created using: Interfaces (IActionFilter, IAsyncActionFilter…) Attributes Dependency injection Example – Custom Header Validation Filter public class HeaderValidationFilter : IActionFilter

Example code

{
public void OnActionExecuting(ActionExecutingContext context)
{
if (!context.HttpContext.Request.Headers.ContainsKey("X-Client-Id")) { context.Result = new BadRequestObjectResult("Missing X-Client-Id header."); }
}
public void OnActionExecuted(ActionExecutedContext context) { }
}

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: RequestDelegate is a delegate representing the next middleware in the pipeline: public delegate Task RequestDelegate(HttpContext context); In custom middleware, it allows passing control to the next component.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: They run before model binding and after authorization. Perfect for caching or request trimming.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ✔ Use Filters When: You need information about controller or action context You need pre/post action execution access Logic must execute only on MVC actions ❌ Avoid Filters If: Logic applies to all HTTP requests → use middleware Heavy database operations are needed in every request ⚠ Pitfall: Filters run per action. Be mindful of expensive operations.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Explain a bit more

pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline. pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Middleware is executed in the order it's added, and this order affects behavior.

Example code

app.UseAuthentication(); // Must come before authorization app.UseAuthorization(); app.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Set context.Result = new BadRequestObjectResult(...).

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Concern Use Filter Use Middleware Needs controller context ✔ ❌ Needs access before routing ❌ ✔ Validating request body ❌ ✔ Logging per action ✔ ❌ Exception handling ✔ ✔ 💡 Tip: If your logic is unrelated to MVC actions (e.g., CORS, compression), middleware is the right choice.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: wait next(); // only called if authenticated wait next(); // only called if authenticated wait next(); // only called if authenticated wait next(); // only called if authenticated

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Simply don’t call await next() in a middleware: if (!context.User.Identity.IsAuthenticated)

Example code

{
context.Response.StatusCode = 401;
return; // Short-circuits
}
await next(); // only called if authenticated

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Yes—via constructor injection, ServiceFilter, or TypeFilter.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: SP.NET Core filters support DI via:

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: app.UseStaticFiles() enables serving files from wwwroot. Important: It must be added before routing or endpoints so static files are served without invoking controller logic. app.UseStaticFiles(); app.UseRouting(); app.UseEndpoints(...);

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Async filters implement IAsyncActionFilter and support await, improving scalability.

Example code

Async filters implement IAsyncActionFilter and support await, improving scalability.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: 🏦 Fintech API – Global Exception Filter Ensures consistent error envelopes across microservices. 🛠 Microservices – Audit Logging Tracks when sensitive controller actions are executed. 👮 Role-based Authorization Custom authorization filter validating role claims dynamically. 🚀 Performance Profiling Times how long each controller method takes. public class ProfilingFilter : IActionFilter

Example code

{
private Stopwatch _watch;
public void OnActionExecuting(ActionExecutingContext context)
{
_watch = Stopwatch.StartNew();
}
public void OnActionExecuted(ActionExecutedContext context)
{ _watch.Stop(); Console.WriteLine($"Action took {_watch.ElapsedMilliseconds} ms"); }
}

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: custom page or handler. if (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); }); custom page or handler.…

Example code

if… (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); }); custom page or handler. Example: if (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); }); custom page or handler.… Example: if (env.IsDevelopment()) pp.UseDeveloperExceptionPage(); else pp.UseExceptionHandler("/Error"); Or inline: pp.UseExceptionHandler(errorApp => { errorApp.Run(async context => { context.Response.StatusCode = 500; wait context.Response.WriteAsync("An error occurred"); }); });

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: (UseExceptionHandler, UseDeveloperExceptionPage) UseDeveloperExceptionPage() shows detailed errors (development only). UseExceptionHandler("/Error") handles errors in production with a custom page or handler. Example: if (env.IsDevelopment()) app.UseDeveloperExceptionPage(); else app.UseExceptionHandler("/Error"); Or inline: app.UseExceptionHandler(errorApp => { errorApp.Run(async context => {

Example code

context.Response.StatusCode = 500;
await context.Response.WriteAsync("An error occurred"); }); });

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Yes. They form a pipeline based on their defined order.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters execute per controller action → use sparingly. Avoid heavy DB calls. Avoid creating new HttpClients or DbContexts inside filters. Prefer asynchronous filters.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing.

Explain a bit more

You can configure HTTPS ports in launchSettings.json or ppsettings.json. pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or ppsettings.json. pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or ppsettings.json. pp.UseHttpsRedirection(); dd early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or ppsettings.json.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Redirects HTTP requests to HTTPS. app.UseHttpsRedirection(); Add early in the pipeline, before auth or routing. You can configure HTTPS ports in launchSettings.json or appsettings.json.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: The sequence in which filters run. Lower Order value = earlier execution.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use: ActionExecutingContext mocks ActionExecutedContext mocks DefaultHttpContext var httpContext = new DefaultHttpContext(); var context = new ActionExecutingContext(...); Focus tests on: Expected results Short-circuiting behavior Context manipulation

Example code

Use: ActionExecutingContext mocks ActionExecutedContext mocks DefaultHttpContext var httpContext = new DefaultHttpContext();
var context = new ActionExecutingContext(...); Focus tests on: Expected results Short-circuiting behavior Context manipulation

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: app.UseStaticFiles(new StaticFileOptions { FileProvider = new PhysicalFileProvider(Path.Combine(env.ContentRootPath, "MyFiles")), RequestPath = "/Files", OnPrepareResponse = ctx => { ctx.Context.Response.Headers.Append("Cache-Control", "public,max-age=600"); } }); For directory browsing: app.UseDirectoryBrowser(new DirectoryBrowserOptions { FileProvider = new PhysicalFileProvider("path"), RequestPath = "/browse" });

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: When your logic depends on controller/action context, such as reading route values or action arguments.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.