Interview Q&A

Short answer: Filters run in a specific order depending on their type: Authorization filters run first.

Explain a bit more

Resource filters run next. Model binding happens after resource filters. Action filters run around the action execution. Exception filters handle exceptions thrown during action or result execution. Result filters run around result execution. Within each type, filters can be ordered by their Order property and whether they are global, controller-level, or action-level.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Create a custom filter by implementing one of the filter interfaces like: public class CustomActionFilter : IActionFilter

Example code

{
public void OnActionExecuting(ActionExecutingContext context)
{ // Before action executes }
public void OnActionExecuted(ActionExecutedContext context)
{ // After action executes }
} Register globally in Startup: services.AddControllersWithViews(options => { options.Filters.Add<CustomActionFilter>(); }); Or decorate controllers/actions: [ServiceFilter(typeof(CustomActionFilter))] public class HomeController : Controller { ... }

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ctions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Global filters apply to all MVC actions, registered via AddControllers or AddMvc options. Controller or action filters are applied via attributes directly on controllers or actions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters receive context objects (e.g., ActionExecutingContext) providing: HTTP context and request data. Access to action parameters. Ability to modify or cancel execution (e.g., short-circuit). Access to the result or exceptions. Ability to set result or modify response. This allows filters to inspect, modify, or block processing at their stage.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters can short-circuit by setting the result early, preventing further execution: public void OnActionExecuting(ActionExecutingContext context)

Example code

{
if (!IsAuthorized())
{
context.Result = new UnauthorizedResult(); // stops pipeline here }
} This prevents action execution and later filters from running.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filter attributes are instantiated per request and support parameters, but have limited DI capabilities. Service-based filters (using ServiceFilter or TypeFilter) allow filters to be resolved from DI container, enabling constructor injection. Use service-based filters when you need dependencies injected.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthentication). Use filters for MVC-specific concerns tied to action execution (authorization, validation, caching). Filters can complement middleware for granular control within MVC. Example: Use middleware for global exception logging, filters for handling MVC-specific exceptions and returning appropriate views or API responses. Versioning,… CORS

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use middleware for concerns that affect all requests (logging, CORS, authentication). Use filters for MVC-specific concerns tied to action execution (authorization, validation, caching). Filters can complement middleware for granular control within MVC. Example: Use middleware for global exception logging, filters for handling MVC-specific exceptions and returning appropriate views or API responses. Versioning, CORS

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: API versioning enables multiple versions of your API to coexist, allowing clients to migrate gradually.

Explain a bit more

Common ways to version APIs in ASP.NET Core: URL versioning (e.g., /api/v1/products) Query string versioning (e.g., /api/products?api-version=1.0) Header versioning (custom header like api-version: 1.0) ● Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true;

Example code

options.DefaultApiVersion = new ApiVersion(1, 0);
options.ReportApiVersions = true; });

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: api-version=1.0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new ApiVersion(1, 0);……… api-version=1.

Explain a bit more

0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new ApiVersion(1, 0); options.ReportApiVersions = true; }); api-version=1.0) Header versioning (custom header like api-version: 1.0) Media type versioning (via Accept header, e.g., application/json;v=1) Use the Microsoft.AspNetCore.Mvc.Versioning NuGet package: services.AddApiVersioning(options => { options.AssumeDefaultVersionWhenUnspecified = true; options.DefaultApiVersion = new…

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Semantic versioning (semver) uses MAJOR.MINOR.PATCH format, e.g., 1.2.0. MAJOR version changes break backward compatibility. MINOR versions add functionality in a backward-compatible manner. PATCH versions are for backward-compatible bug fixes. Version negotiation allows clients and servers to agree on an API version via headers or URL. Servers should support multiple versions and respond with supported version info.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Mark old versions as deprecated via documentation and HTTP response headers. Return warning headers or custom fields indicating version deprecation. Gradually phase out old versions, allowing clients to migrate. Consider introducing sunset policies and endpoints to notify clients.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: CORS (Cross-Origin Resource Sharing) is a browser security feature that restricts web pages from making requests to a different domain than the one that served the web page, to prevent cross-site attacks. CORS defines a way for servers to allow controlled access to resources from a different origin.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin"); pp.UseCors("AllowSpecificOrigin");

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Configure in Startup.cs or Program.cs: services.AddCors(options => { options.AddPolicy("AllowSpecificOrigin", builder => { builder.WithOrigins(" .AllowAnyHeader() .AllowAnyMethod(); }); }); Enable middleware: app.UseCors("AllowSpecificOrigin");

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: For certain CORS requests (e.g., methods other than GET/POST or custom headers), browsers send an OPTIONS request first, called a preflight. The server must respond with allowed methods, headers, and origins. Properly configured CORS policies handle preflight requests automatically.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Global CORS: Apply a policy for all endpoints by adding middleware early in the pipeline with app.UseCors(...). Per-endpoint CORS: Apply CORS policies selectively using the [EnableCors("PolicyName")] or [DisableCors] attributes on controllers or actions.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: To allow cookies or credentials in cross-origin requests, configure: builder.WithOrigins(" .AllowCredentials() .AllowAnyHeader() .AllowAnyMethod(); Clients must send requests with credentials: 'include'. Note: Allowing credentials disables the wildcard (*) origin.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Improperly configured CORS can expose your API to CSRF and data theft. Avoid using AllowAnyOrigin with AllowCredentials as browsers block it. Restrict origins to trusted domains. Validate CORS headers and avoid overly permissive policies. Use HTTPS to secure cross-origin requests. Cross‑Cutting / Advanced / “Miscellaneous”

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Kestrel is the default cross-platform web server for ASP.NET Core, lightweight and fast. IIS acts as a reverse proxy on Windows, forwarding requests to Kestrel. Reverse proxies improve security, manage SSL, handle load balancing. On Linux, Nginx or Apache often act as reverse proxies to Kestrel.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: InProcess hosting runs ASP.NET Core app inside the IIS worker process (w3wp.exe), better performance. OutOfProcess hosting runs the app in a separate process, IIS proxies requests to it. InProcess is default in ASP.NET Core 3.0+ for IIS hosting.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Health checks provide endpoints to report app health. Use Microsoft.AspNetCore.Diagnostics.HealthChecks. Configure checks for databases, external services, dependencies. Useful for Kubernetes, load balancers.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core has built-in logging with providers (Console, Debug, EventSource). Third-party libs like Serilog and NLog offer rich sinks, structured logging. Configure logging via appsettings.json or code.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: compression In-memory caching stores data on server memory for fast retrieval. Distributed caching uses external stores (Redis, SQL) for multiple servers. Response compression reduces payload size using gzip, Brotli middleware.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.