Interview Q&A

Short answer: Anti-Forgery Tokens Protects against CSRF attacks In Razor: <form method="post"> @Html.AntiForgeryToken() </form> In API: use services.AddAntiforgery(), validate via [ValidateAntiForgeryToken]. 1⃣

Real-world example (ShopNest)

ShopNest’s product edit form posts to an MVC action. Model binding fills a ProductEditVm; the action validates and redisplay the view on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Creating REST APIs in ASP.NET Core is straightforward using controllers or minimal PIs.

Explain a bit more

Example: Traditional Controller-Based API dotnet new webapi -n MyApi Program.cs: var builder = WebApplication.CreateBuilder(args); builder.Services.AddControllers(); var app = builder.Build(); pp.MapControllers(); pp.Run(); Controller: [ApiController] [Route("api/[controller]")] public class ProductsController : ControllerBase { [HttpGet] public IActionResult GetAll() => Ok(new[] { "Laptop", "Phone" }); } ✅ You get RESTful endpoints automatically (GET /api/products). {

Example code

if (!ModelState.IsValid)
return BadRequest(ModelState);
return CreatedAtAction(nameof(CreateOrder), new { id = 1 }, order); }
} 📦 3. How does content negotiation work? Content negotiation allows clients to request responses in a specific format (JSON, XML, etc.) using the Accept header. SP.NET Core automatically picks the best formatter: GET /api/products ccept: application/json Response → JSON GET /api/products ccept: application/xml Response → XML (if XML formatter is added) Enable XML Support: builder.Services.AddControllers() .AddXmlSerializerFormatters(); 🧭 4. How to handle versioning in APIs? You can version APIs to maintain backward compatibility using the Microsoft.AspNetCore.Mvc.Versioning package. Install: dotnet add package Microsoft.AspNetCore.Mvc.Versioning Configure: builder.Services.AddApiVersioning(options => {
options.DefaultApiVersion = new ApiVersion(1, 0);
options.AssumeDefaultVersionWhenUnspecified = true;
{ [HttpGet] public IActionResult Get() => Ok("Version 1");
} ⚠ 5. What is ProblemDetails? ProblemDetails is a standardized JSON structure for API error responses (RFC 7807). Example Output: { "type": " "title": "Resource not found", "status": 404, "detail": "Product with ID 5 was not found" } Usage: return NotFound(new ProblemDetails
{ Title = "Product not found", Status = StatusCodes.Status404NotFound, Detail = "The product ID 5 does not exist." }); 🚦 6. How to return custom HTTP status codes? You can use built-in helpers from ControllerBase: Method Status Code Ok() 200 Created() / CreatedAtAction() 201 NoContent() 204 BadRequest() 400 Unauthorized() 401 NotFound() 404 StatusCode(500) Custom Example: return StatusCode(503, "Service temporarily unavailable"); 📄 7. How to implement pagination in APIs? Pagination helps manage large datasets efficiently. Example: [HttpGet] public IActionResult GetProducts([FromQuery] int page = 1, [FromQuery] int size = 10) {
var data = _context.Products .Skip((page - 1) * size) .Take(size) .ToList(); var totalCount = _context.Products.Count(); Response.Headers.Add("X-Total-Count", totalCount.ToString()); return Ok(data);
} ✅ Supports GET /api/products?page=2&size=5. 🔐 8. How to secure APIs with JWT tokens? Use JWT (JSON Web Token) authentication for stateless security. Setup in Program.cs: builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationS cheme) .AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidIssuer = " ValidateAudience = true, ValidAudience = " IssuerSigningKey = new SymmetricSecurityKey( Encoding.UTF8.GetBytes("super-secret-key")) }; }); Then protect controllers: [Authorize] [ApiController] [Route("api/[controller]")] public class OrdersController : ControllerBase
{ [HttpGet] public IActionResult GetOrders() => Ok("Secure data");
} ⚡ 9. What is rate limiting in .NET 8? .NET 8 introduces built-in rate limiting middleware to control API request rates. Example: builder.Services.AddRateLimiter(options => { options.AddFixedWindowLimiter("fixed", opt => {
opt.PermitLimit = 5; // 5 requests
opt.Window = TimeSpan.FromSeconds(10); // per 10 seconds
var exception = context.Features.Get<IExceptionHandlerFeature>()?.Error; return Results.Problem(title: "Unexpected error", detail: exception?.Message); }); Or write a custom middleware for consistent error formatting. 🧾 11. How to use Swagger / OpenAPI? Swagger generates interactive API documentation automatically. Setup: builder.Services.AddEndpointsApiExplorer(); builder.Services.AddSwaggerGen(); var app = builder.Build();
if (app.Environment.IsDevelopment())
{ pp.UseSwagger(); pp.UseSwaggerUI(); } Run → Navigate to ✅ You can test endpoints directly from the browser. 🧰 12. What is NSwag or Swashbuckle? Both tools generate OpenAPI/Swagger documentation, but with slight differences: Tool Description Swashbuckle.AspNetCor Most common; adds Swagger UI, docs, and JSON schema NSwag Adds extra features like client SDK generation for C#/TypeScript Example (NSwag client generation): nswag openapi2csclient /input: /output:Client.cs 📤 13. How to upload files via Web API? Use IFormFile for file uploads. Controller Example: [HttpPost("upload")] public async Task<IActionResult> UploadFile(IFormFile file)
{
if (file == null || file.Length == 0)
return BadRequest("No file uploaded.");
var path = Path.Combine("wwwroot/uploads", file.FileName);
using var stream = new FileStream(path, FileMode.Create); wait file.CopyToAsync(stream); return Ok(new { file.FileName, file.Length });
} Client sends multipart/form-data POST requests. 🌐 14. How to implement CORS? CORS (Cross-Origin Resource Sharing) allows requests from other domains (e.g., frontend pps). Enable in Program.cs: builder.Services.AddCors(options => { options.AddPolicy("AllowReactApp", policy => policy.WithOrigins(" .AllowAnyHeader() .AllowAnyMethod()); }); var app = builder.Build(); pp.UseCors("AllowReactApp"); ✅ Now your React or Angular frontend can call your API safely. 🚀 15. What’s new in .NET 8 Minimal APIs? Minimal APIs let you build lightweight REST endpoints without controllers — great for microservices. Example: var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

Real-world example (ShopNest)

ShopNest admin screens use MVC: controller loads data, Razor view renders HTML, Tag Helpers build forms safely.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseAuthentication(); pp.UseAuthorization(); pp.UseAuthentication(); pp.UseAuthorization(); pp.UseAuthentication(); pp.UseAuthorization(); pp.UseAuthentication(); pp.UseAuthorization();

Real-world example (ShopNest)

ShopNest admin screens use MVC: controller loads data, Razor view renders HTML, Tag Helpers build forms safely.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core Identity is a membership system that manages users, passwords, roles, claims, and authentication.

Explain a bit more

It provides: User registration & login Password hashing Role & claims management Two-factor authentication Cookie & token-based authentication You can scaffold Identity to get ready-to-use pages for login, registration, and password reset. ASP.NET Core Identity is a membership system that manages users, passwords, roles, claims, and authentication. It provides: User registration & login Password hashing Role & claims management Two-factor authentication Cookie & token-based authentication

Example code

You can scaffold Identity to get ready-to-use pages for login, registration, and password reset. ASP.NET Core Identity is a membership system that manages users, passwords, roles, claims, and authentication. It provides: User registration & login Password hashing Role & claims management Two-factor authentication Cookie & token-based authentication Example: You can scaffold Identity to get ready-to-use pages for login, registration, and password reset. ⚙ 2. How do you configure Identity in ASP.NET Core? Add Identity services in Program.cs: builder.Services.AddDbContext<AppDbContext>(options => options.UseSqlServer(builder.Configuration.GetConnectionString("Defa ultConnection"))); builder.Services.AddIdentity<ApplicationUser, IdentityRole>() .AddEntityFrameworkStores<AppDbContext>() .AddDefaultTokenProviders(); ASP.NET Core Identity is a membership system that manages users, passwords, roles, claims, and authentication. It provides: User registration & login Password hashing Role & claims management Two-factor authentication Cookie & token-based authentication Example: You can scaffold Identity to get ready-to-use pages for login, registration, and password reset. ⚙ 2. How do you configure Identity in ASP.NET Core? Add Identity services in Program.cs: builder.Services.AddDbContext<AppDbContext>(options => options.UseSqlServer(builder.Configuration.GetConnectionString("Defa ultConnection"))); builder.Services.AddIdentity<ApplicationUser, IdentityRole>() .AddEntityFrameworkStores<AppDbContext>() .AddDefaultTokenProviders();

Real-world example (ShopNest)

ShopNest admin screens use MVC: controller loads data, Razor view renders HTML, Tag Helpers build forms safely.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: If you change appsettings.json and configuration reload is enabled, IOptionsMonitor picks up the new value without restarting the app. Entity Framework Core

Real-world example (ShopNest)

ShopNest admin screens use MVC: controller loads data, Razor view renders HTML, Tag Helpers build forms safely.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: MVC stands for Model–View–Controller, a design pattern that separates application logic into three layers: Model – Represents the data and business logic (e.g., Product, Customer, Order). View – The UI or presentation layer that displays data (Razor views). {

Example code

public IActionResult Details(int id)
{
var product = _service.GetById(id);
return View(product);
}
} Notes: Action methods cannot be private or static. They respond to routes like /Product/Details/5. 🎯 6. What are Action Results? An Action Result represents the response returned to the client — view, JSON, redirect, file, etc. SP.NET Core provides many result types: ViewResult JsonResult RedirectResult FileResult ContentResult StatusCodeResult 🔍 7. Difference between ViewResult, JsonResult, and ContentResult. Type Used For Example ViewResult Returns an HTML view return View("Details", model); JsonResult Returns JSON data return Json(model); ContentResul Returns plain text or custom content return Content("Hello World"); IActionResult is an interface that represents the result of an action method. It allows flexibility — you can return any kind of result (view, JSON, redirect, etc.) from the same method. Example: public IActionResult Index()
{
if (!User.Identity.IsAuthenticated)
return RedirectToAction("Login");
return View();
} 🧠 9. How does model binding work? Model binding automatically maps data from the HTTP request (query string, route, body, form) to method parameters or model objects. Example: public IActionResult Save(Product model)
{ // model properties are automatically filled _service.Add(model); return RedirectToAction("Index");
}
{ [Required] public string Name { get; set; } [Range(1, 10000)] public decimal Price { get; set; }
} In a controller: if (!ModelState.IsValid)
return View(model);

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Inject config via environment variables or secret stores in pipelines. Use multiple config files per environment (appsettings.Development.json). Secure sensitive values using CI/CD secret management.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use resource files (.resx) for strings. Configure RequestLocalizationMiddleware. Support multiple cultures and fallback cultures. Localize data formats, dates, currencies.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: injection, XSS etc) Use parameterized queries / ORM to prevent SQL injection. Sanitize and encode user input to prevent XSS. Validate inputs rigorously on server side. Use built-in validation attributes and custom validators. Sample / Misc Interview Questions

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: IActionResult: Represents a non-generic result of an action method. Can return any HTTP response (Ok, NotFound, Redirect, etc.). ActionResult<T>: Combines a result with a typed value (T). It allows returning typed data or an HTTP response. Improves clarity and enables better OpenAPI docs.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: In .NET 5 and earlier, Startup configures services and middleware. In .NET 6+ minimal hosting model, the Program.cs file combines service registration and middleware setup with a simplified, top-level statement style. Startup can still be used for organization, but not required.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Update target framework in project file (net8.0). Update NuGet packages and dependencies. Adapt code for minimal APIs if desired. Replace Startup with minimal hosting model if preferred. Test thoroughly for API changes or obsoleted APIs. Review and update middleware and routing patterns.

Example code

Update target framework in project file (net8.0). Update NuGet packages and dependencies. Adapt code for minimal APIs if desired. Replace Startup with minimal hosting model if preferred. Test thoroughly for API changes or obsoleted APIs. Review and update middleware and routing patterns.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Minimal APIs are lightweight endpoints defined with top-level statements, no controller classes. Ideal for microservices or simple APIs. Less ceremony and fewer files. Controllers provide richer features (filters, model binding, action results).

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use binding redirects (in .NET Framework). Use assembly version unification and strong-named assemblies. In .NET Core, resolve via NuGet package management, use central package versions. Consider upgrading or consolidating dependencies.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Introduced in ASP.NET Core 3.0. Centralized routing system that decouples route matching from middleware. Routes requests to endpoints defined by controllers, Razor Pages, minimal APIs. Supports route-based middleware filters.

Example code

Introduced in ASP.NET Core 3.0. Centralized routing system that decouples route matching from middleware. Routes requests to endpoints defined by controllers, Razor Pages, minimal APIs. Supports route-based middleware filters.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pplied globally. Attribute routing: Routes declared directly on controllers/actions via attributes ([Route], [HttpGet]). Attribute routing is more flexible and explicit.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Conventional routing: Routes defined centrally (usually in Startup), patterns applied globally. Attribute routing: Routes declared directly on controllers/actions via attributes ([Route], [HttpGet]). Attribute routing is more flexible and explicit.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Add Swashbuckle.AspNetCore NuGet package. Configure Swagger services (builder.Services.AddSwaggerGen()). Enable middleware (app.UseSwagger(), app.UseSwaggerUI()). Customize with options like API info, document filters, UI themes.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: types Automatically selects response format (JSON, XML) based on Accept header. Configured via formatters in MVC options. Falls back to default formatter if no match.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Standardized error response format defined by RFC 7807. Contains properties like status, title, detail, instance. Used by default in ASP.NET Core for error responses.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: error responses Implement custom exception handling middleware. Catch exceptions, set HTTP status, and return custom JSON payload. Use UseExceptionHandler() or global filters. Customize ProblemDetails or your own error models.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Accept CancellationToken parameter in action methods. Pass token to async calls to support request cancellation. Improves responsiveness and resource management.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: configure them Default max request body size is 30 MB. Configure via RequestSizeLimit attribute or KestrelServerOptions.Limits.MaxRequestBodySize. For IIS, adjust maxAllowedContentLength.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Add ResponseCompression middleware. Register compression providers (AddResponseCompression()) in Program.cs. Configure supported MIME types and compression level.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: System.Text.Json: Default in .NET Core 3+, fast, built-in, less feature-rich. Newtonsoft.Json: More mature, supports advanced scenarios (e.g., polymorphic deserialization). Can switch to Newtonsoft by adding AddNewtonsoftJson() in MVC options.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.