Interview Q&A

Short answer: A filter is a component that allows logic to be executed before or after parts of the request pipeline, such as authorization, action execution, or result processing.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters are ASP.NET Core’s plug-in points that allow you to inject logic before or after specific pipeline stages such as: Authorization Resource execution Action execution Results processing Exception handling They help you implement cross-cutting concerns without cluttering controllers or actions.

Explain a bit more

In enterprise systems, filters are indispensable for: Logging Validation Authorization Error handling Performance profiling Policy enforcement

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Middleware is a component in the HTTP request pipeline that can: Handle requests, Pass requests to the next middleware, Or short-circuit the pipeline. Middleware can: Perform actions before and/or after the next middleware executes. Be used for logging, authentication, error handling, etc. Middleware executes in the order it's added in Program.cs.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Historically, developers would sprinkle try-catch blocks, logging frameworks, and authorization checks directly inside controllers. This led to: Repetition Hard-to-test classes Cross-cutting concerns polluting business logic Fragile code Filters solve these by offering centralized, consistent, and reusable implementation points.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthorization, Resource, Action, Exception, and Result filters.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthorization checks directly inside controllers. This led to: Repetition Hard-to-test classes Cross-cutting concerns polluting business logic Fragile code Filters solve these by offering centralized, consistent, and reusable implementation points.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseMiddleware<YourMiddleware>(); pp.UseRouting(); pp.UseEndpoints(endpoints => { endpoints.MapControllers(); }); pp.Run(); In older versions (e.g., .NET Core 3.1), Startup.cs is used: public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { pp.UseMiddleware<YourMiddleware>(); pp.UseRouting(); pp.UseEndpoints(endpoints => {………… pp.UseMiddleware<YourMiddleware>(); pp.UseRouting();…

Explain a bit more

pp.UseEndpoints(endpoints => { endpoints.MapControllers(); }); pp.Run(); In older versions (e.g., .NET Core 3.1), Startup.cs is used: public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { pp.UseMiddleware<YourMiddleware>(); pp.UseRouting(); pp.UseEndpoints(endpoints => { endpoints.MapControllers(); }); } pp.UseMiddleware<YourMiddleware>(); pp.UseRouting(); pp.UseEndpoints(endpoints => { endpoints.MapControllers(); }); pp.Run(); In older versions (e.g., .NET Core 3.1), Startup.cs is used: public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { pp.UseMiddleware<YourMiddleware>(); pp.UseRouting();…

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: var app = builder.Build(); app.UseMiddleware<YourMiddleware>(); app.UseRouting(); app.UseEndpoints(endpoints => { endpoints.MapControllers(); }); app.Run(); In older versions (e.g., .NET Core 3.1), Startup.cs is used: public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { app.UseMiddleware<YourMiddleware>(); app.UseRouting(); app.UseEndpoints(endpoints => { endpoints.MapControllers(); }); }

Example code

In ASP.NET Core 6+ (minimal hosting model), middleware is added in Program.cs: var builder = WebApplication.CreateBuilder(args);

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters promote reusability, separation of concerns, cleaner controllers, and easier maintenance.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Example – Using ServiceFilter [ServiceFilter(typeof(AuditLogFilter))] public class UserController : ControllerBase { }

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthorization Before everything Identity, JWT, RBAC Resource Before model binding Caching, request trimming ction Before/after action Logging, validation Exception On unhandled errors Global error handling Result Before/after result Response wrapping, formatting Endpoint (ASP.NET Core 7+) round minimal API endpoints Logging, validation 3.1… Authorization……… Filters These execute first, determining whether the user…

Explain a bit more

can access the route. public AuditLogFilter(ILogger<AuditLogFilter> logger)

Example code

{
_logger = logger;
}
public void OnActionExecuting(ActionExecutingContext context)
{ _logger.LogInformation("Request started at: {time}", DateTime.UtcNow); }
public void OnActionExecuted(ActionExecutedContext context)
{ _logger.LogInformation("Request ended at: {time}", DateTime.UtcNow); }
} 3.4 Exception Filters Centralizing error handling is vital in fintech and healthcare APIs. Example use cases: Returning consistent error envelopes Logging unhandled exceptions Protecting internal stack traces 3.5 Result Filters These wrap the response. Use cases: Response compression Standardizing API responses Masking sensitive data 3.6 Endpoint Filters (ASP.NET Core 7+) Primarily for minimal APIs. Example use cases: Request validation Logging Caching Response transformation pp.MapGet("/users/{id}", (int id) => GetUser(id)) .AddEndpointFilter(new LoggingEndpointFilter());

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Authorization Filters Resource Filters Action Filters Exception Filters Result Filters Endpoint Filters (ASP.NET Core 7+)

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Action filters wrap the action method; result filters wrap the returned result (like ObjectResult or ViewResult).

Example code

Action filters wrap the action method; result filters wrap the returned result (like ObjectResult or ViewResult).

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Diagram) -------------------------- | Authorization Filter | -------------------------- -------------------------- | Resource Filter | -------------------------- -------------------------- | Model Binding Happens | -------------------------- -------------------------- | Action Filter | -------------------------- -------------------------- | Action Method | -------------------------- -------------------------- |…

Explain a bit more

Result Filter | -------------------------- -------------------------- | Response Returned | --------------------------

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: wait _next(context); // Post-processing logic } } Register it: pp.UseMiddleware<MyCustomMiddleware>(); wait _next(context); // Post-processing logic } } Register it: pp.UseMiddleware<MyCustomMiddleware>(); wait _next(context); // Post-processing logic } } Register it: pp.UseMiddleware<MyCustomMiddleware>(); wait _next(context); // Post-processing logic } }… Register it: pp.UseMiddleware<MyCustomMiddleware>();

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Create a class with: A constructor accepting RequestDelegate An Invoke or InvokeAsync method public class MyCustomMiddleware { private readonly RequestDelegate _next; public MyCustomMiddleware(RequestDelegate next) => _next = next; public async Task InvokeAsync(HttpContext context) { // Pre-processing logic await _next(context); // Post-processing logic } } Register it: app.UseMiddleware<MyCustomMiddleware>();

Example code

Create a class with: A constructor accepting RequestDelegate An Invoke or InvokeAsync method public class MyCustomMiddleware
{
private readonly RequestDelegate _next;
public MyCustomMiddleware(RequestDelegate next) => _next = next; public async Task InvokeAsync(HttpContext context)
{ // Pre-processing logic await _next(context); // Post-processing logic }
} Register it: app.UseMiddleware<MyCustomMiddleware>();

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthorization filters always run first. Intermediate Level

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters can be created using: Interfaces (IActionFilter, IAsyncActionFilter…) Attributes Dependency injection Example – Custom Header Validation Filter public class HeaderValidationFilter : IActionFilter

Example code

{
public void OnActionExecuting(ActionExecutingContext context)
{
if (!context.HttpContext.Request.Headers.ContainsKey("X-Client-Id")) { context.Result = new BadRequestObjectResult("Missing X-Client-Id header."); }
}
public void OnActionExecuted(ActionExecutedContext context) { }
}

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: RequestDelegate is a delegate representing the next middleware in the pipeline: public delegate Task RequestDelegate(HttpContext context); In custom middleware, it allows passing control to the next component.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: They run before model binding and after authorization. Perfect for caching or request trimming.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ✔ Use Filters When: You need information about controller or action context You need pre/post action execution access Logic must execute only on MVC actions ❌ Avoid Filters If: Logic applies to all HTTP requests → use middleware Heavy database operations are needed in every request ⚠ Pitfall: Filters run per action. Be mindful of expensive operations.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Explain a bit more

pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline. pp.UseAuthentication(); // Must come before authorization pp.UseAuthorization(); pp.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Middleware is executed in the order it's added, and this order affects behavior.

Example code

app.UseAuthentication(); // Must come before authorization app.UseAuthorization(); app.UseEndpoints(...); Logging, error handling, and security middlewares must be early in the pipeline.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Set context.Result = new BadRequestObjectResult(...).

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Concern Use Filter Use Middleware Needs controller context ✔ ❌ Needs access before routing ❌ ✔ Validating request body ❌ ✔ Logging per action ✔ ❌ Exception handling ✔ ✔ 💡 Tip: If your logic is unrelated to MVC actions (e.g., CORS, compression), middleware is the right choice.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.