Why ASP.NET Core
List the advantagesCross-platform and fast, with DI, config and logging built in.
Compare it with ASP.NET FrameworkFramework is Windows only. Core builds its pipeline from middleware.
TrapWeb Forms never moved to Core.
ASP.NET Core
Done 0/0
To review 0
Old way, still asked about
The usual way today
Newer, .NET 8 or later
The model
Program.cshas two halves. Register services onbuilder., callServices builder.Build(), then add middleware toapp.- Middleware runs in the order you add it, and the response passes back in reverse. A component that skips
nextshort-circuits the request. - Routing matches a request to an endpoint, the code that handles it. That's a controller action, a Razor Page or a minimal API handler.
- The DI container creates services for you. A lifetime sets how long each one lives. Singleton is per app, scoped per request, transient per injection.
- Configuration merges several sources into one set of keys. The later source wins, so environment variables override JSON files.
Program.cs & hosting
how an app starts and what serves itStartup class or Program.cs
Set up an app before .NET 6
ConfigureServices ConfigureSet up an app today
builder.Services app.UseRouting() TipServices go in Configure or builder., middleware in Configure or on app.
TrapStartup still works. Microsoft advises against it.
Kestrel and the host
Name the default serverKestrel. It's cross-platform and supports HTTP/3.
Say where it runsWindows or Linux in production. macOS for development and testing.
Host an app the old way
IWebHostHost an app today
IHostWebApplicationTipKestrel can run alone or behind IIS, Nginx or Apache. A proxy can add HTTPS certificates and load balancing.
TrapIWebHost and WebHostBuilder are obsolete in .NET 10. Using them gives a compiler warning.
Middleware & filters
what runs around each requestUse, Run and Map
Do work, then call
nextapp.Use(...)End the pipeline
app.Run(...)Branch on a path prefix
app.Map(...)Stop a request earlySkip
next. That short-circuits the pipeline.TipWebApplication implements IApplication, which builds the pipeline.
TrapA Run handler ends the pipeline, so nothing added after it is called.
Put middleware in order
app.UseExceptionHandler();first, catches the restapp.UseHttpsRedirection();app.UseStaticFiles();files stop hereapp.UseRouting();app.UseCors();app.UseAuthentication();app.UseAuthorization();app.MapControllers();
TrapAuthorization placed before authentication sees every user as anonymous.
Asked in interviews
AskedWhy is the order of middleware important in ASP.NET Core?Write a middleware class
Take
next, then handle the requestRequestDelegateInvokeAsync(ctx) Add it to the pipeline
app.UseMiddleware<T>() Activate it per request
IMiddlewareTrapConvention-based middleware is created once for the app. Add scoped services as InvokeAsync parameters.
Asked in interviews
AskedHow do you create custom middleware in ASP.NET Core?Serve static files
Serve
wwwroot on .NET 9+app.MapStaticAssets() Serve other files, or before .NET 9
app.UseStaticFiles() TipMapStaticAssets compresses and fingerprints the files.
Trapwwwroot is the web root, and everything in it is public. Never put secrets there.
Filters
1 Authorizationstops the request2 Resourcebefore model binding3 Actionaround the action4 Exceptionunhandled exceptions5 Resultonly on success
Handle every requestMiddleware. It sees only
HttpContext.Read action argumentsA filter. Only filters see MVC objects.
TipRazor Pages use page filters. Minimal APIs use endpoint filters.
Handle exceptions
Catch errors in production
UseExceptionHandler() Return a standard error body
AddProblemDetails() Map your own exceptions
IExceptionHandler TipCreateBuilder turns on the Developer Exception Page in Development only.
TrapOnce the response has started, you can't change the status code.
Asked in interviews
AskedHow do you handle exceptions in ASP.NET Core?Dependency injection
who creates your objects and how long they liveService lifetimes
Two requests, each injecting the service three times. Singleton keeps one instance, scoped makes two and transient makes six.
Share one per app
AddSingleton<I, T>()Share one per request
AddScoped<I, T>()Make one per injection
AddTransient<I, T>()Get a serviceAsk for the interface in the constructor.
Use a scoped service from a singleton
IServiceScopeFactory TrapA singleton holding a scoped service is a captive dependency. Scope validation throws in Development.
Keyed services
Register under a key
AddKeyedSingleton<I, T>("big")Ask for one by key
[FromKeyedServices("big")] TipWithout keys, you get the last registration.
TrapA key with no registration fails only at run time, with an Invalid.
Asked in interviews
AskedWhat problem do keyed services solve in ASP.NET Core?Settings, secrets & logs
where config comes from and how code reads itConfiguration sources
1 appsettings.json2 appsettings.{Environment}.json3 user secretsDevelopment only4 environment variables5 command-line argumentswins over all
Write a nested key as an environment variable
Logging__LogLevel__Default TrapNever store passwords in appsettings.. It often ends up in source control.
Read settings
Read a raw string
config["Api:Key"]Read a typed value
GetValue<int>(key, 30)Read a connection string
GetConnectionString(name) Bind a section to a class
Configure<T>(section)TrapGetSection never returns null, so a null check won't catch a missing section.
Asked in interviews
AskedHow do you use the IConfiguration interface?IOptions, Snapshot or Monitor
IOptions<T>Read once, the cheapestIOptionsSnapshot<T> Recompute per requestIOptionsMonitor<T> Always read current valuesyesno
TrapIOptions is scoped, so you can't inject it into a singleton.
Environments
Set the name
ASPNETCORE_ENVIRONMENT Read it and branch on it
IWebHostEnvironment IsDevelopment()Do that in old code
IHostingEnvironment TrapWith no variable set, the app runs as Production.
Secrets
Store one in development
dotnet user-secrets set "Api:Key" "123"Store one in productionA store such as Azure Key Vault.
TrapThe Secret Manager's file isn't encrypted. Use it for development only.
Asked in interviews
AskedHow do you manage sensitive data in an ASP.NET Core application?Logging
Get a logger
ILogger<T>Write a structured message
LogInformation("Item {Id}", id)TipSet levels in the Logging section. The default is Information.
TrapDon't build the string yourself. Named placeholders let providers store the values as fields.
Asked in interviews
AskedHow is logging implemented in ASP.NET Core?Routes & REST APIs
map URLs to codeRouting
Define one pattern for views
{controller=Home}/{action=Index}/{id?} Put a route on an API action
[HttpGet("{id}")] Say how it picks and runs an endpoint
UseRouting picks it. UseEndpoints runs it.TipMiddleware between them can read endpoint metadata.
TrapA failed {id:int} constraint returns 404, but bad input should return 400.
Controllers or minimal APIs
Register and map them
AddControllers() MapControllers() Return 201 after a create
CreatedAtAction(...) Map a route to a handler
app.MapGet(path, handler)Pick oneMinimal for new APIs, controllers for OData or large MVC apps.
TipDerive from ControllerBase. [ApiController] requires attribute routing and returns 400 on bad input.
Bind and validate input
Pick the source
[FromQuery][FromBody]Name the default orderForm, body, route data, query string, files.
Write custom validation
ValidationAttribute IValidatableObject TrapWithout [ApiController], the action runs on a bad model. Check Model.
Version an API
Add versioning
Asp.Versioning.Mvc Asp.Versioning.Http Do it the deprecated way
Microsoft.AspNetCore.Mvc.Versioning Send it in the path or a header
/api/v1/products HeaderApiVersionReader TrapBy default every client must send a version. Set Assume to keep old clients working.
Asked in interviews
AskedHow do you implement API versioning in ASP.NET Core Web APIs?OpenAPI and Swagger UI
Generate it on .NET 9+
AddOpenApi()app.MapOpenApi() Add an interactive page
Swashbuckle.AspNetCore.SwaggerUi Do it in older projects
AddSwaggerGen()TrapKeep both in Development only, or you expose API details.
Rate limiting
Register and add it
AddRateLimiter(...) app.UseRateLimiter() Attach a policy
RequireRateLimiting(name) Name the four limitersFixed window, sliding window, token bucket, concurrency.
TrapPartition by user or API key. Partitioning on an IP address can itself open a denial of service risk.
Asked in interviews
AskedHow do you implement rate limiting in an ASP.NET Core Web API?HttpContext
Say what it holdsOne request and its response.
Reach it from a service
IHttpContextAccessor TrapIt's recycled after the request and it isn't thread-safe. Copy the values you need before you start other work.
Asked in interviews
AskedWhat is HttpContext, and why shouldn't you use it outside its request?Views, Razor Pages & Blazor
render HTMLMVC, Areas and Razor Pages
Name the three MVC partsModel holds data and logic, view renders, controller handles input.
Split a big app up
[Area("Billing")]Handle each verb on a page
OnGet()OnPost()Bind posted values
[BindProperty]TipA Razor Page is a .cshtml file with @page plus a PageModel. Its URL comes from its path.
Razor and Tag Helpers
Write a value into HTML
@Model.NameAdd a model or service
@model@injectBuild a link from routes
asp-action="Index" Bind an input to a property
asp-for="Name"TrapRazor HTML-encodes every string it outputs. Html.Raw skips that, so user input can inject markup.
View component or partial view
Reuse markup only
<partial name="_Cart" />Run code, load data
Component.InvokeAsync("Cart") TrapView components never handle HTTP requests and don't use model binding.
Forms and anti-forgery
Say what the token stopsCSRF, a forged request that uses the user's cookie.
Check the token in MVC
[ValidateAntiForgeryToken] Show a bad form again
return View(model);Redirect after a save
RedirectToAction(name) TipThe final redirect is Post/Redirect/Get. It stops a refresh from posting twice.
TrapAPIs that use a bearer token in a header, not a cookie, aren't exposed to CSRF.
Blazor render modes
Run on the server
InteractiveServer Run in the browser
InteractiveWebAssembly Server first, then browser
InteractiveAutoTipThe fourth mode, static server rendering, sends plain HTML.
Asked in interviews
AskedWhat is Blazor and how does it integrate with ASP.NET Core?Translate the UI
Add services and middleware
AddLocalization() UseRequestLocalization() Look up a string
IStringLocalizer<T> TipCulture formats dates and numbers. UI culture picks the translated strings.
Asked in interviews
AskedHow do you implement globalization and localization in ASP.NET Core?Login, roles & security
who the user is and what they may doAuthentication
Register a JWT scheme
AddAuthentication(...) .AddJwtBearer(...) Pick a schemeCookies for server-rendered apps, JWT for APIs.
TipAnonymous users get a challenge, a login redirect for cookie-protected pages or a 401. Users without permission get a forbid, a 403 with JWT.
TrapConfiguring authentication restricts nothing. Authorization does that.
Asked in interviews
AskedHow do you implement authentication in ASP.NET Core?Authorization and policies
Require sign-in, or open one endpoint
[Authorize][AllowAnonymous] Narrow it to a role or policy
Roles = "Admin"Policy = "AtLeast21"Define a policy with custom logic
AddPolicy(name, ...)AuthorizationHandler<T> Decide from the data
IAuthorizationService Keep new endpoints private
FallbackPolicyTrapWith a fallback policy, static files placed after authorization need a sign-in too.
CORS and HTTPS
Register a named policy
AddCors(...)WithOrigins(url) Apply it
app.UseCors(name) [EnableCors]Enforce HTTPS
UseHttpsRedirection() UseHsts()Stop XSS and SQL injectionRazor encodes output and EF Core helps with SQL.
TipAdd a Content Security Policy, and show detailed errors only in Development.
TrapCORS isn't a protection, because it relaxes the same-origin policy. Never combine AllowAnyOrigin with Allow.
EF Core, caching & sessions
save data, cache it and keep per-user stateEF Core and repositories
Register the context
AddDbContext<AppDb>(...) Say why to use a repositoryTests can mock its interface instead of a database.
Say why to skip it
DbContext is already a Repository and Unit of Work.TipMake one repository per aggregate root, never one per table.
TrapA DbContext is scoped and isn't thread-safe. Never hold one in a singleton.
EF Core migrations
Add a migration
dotnet ef migrations add NameApply the pending ones
dotnet ef database updateDeploy with a bundle or SQL
dotnet ef migrations bundledotnet ef migrations scriptTrapA migration may drop a column you meant to rename. Review the code before you apply it.
Asked in interviews
AskedHow do you manage database migrations with EF Core?Distributed cache and session
Use Redis in production
AddStackExchangeRedisCache() Read and write the cache
IDistributedCache Add stampede protection
HybridCacheTurn on session state
AddSession()app.UseSession() TipThe session cookie holds only the ID. Data expires after 20 idle minutes by default.
TrapAdd stays on one server, so a farm needs sticky sessions or a shared cache.
SignalR, gRPC & background
push to clients, call services, work outside a requestSignalR
Push content to clientsWrite a hub. Each side can call the other's methods.
Name the transportsWebSockets, Server-Sent Events, long polling.
Scale across serversAzure SignalR Service or a Redis backplane.
TipMessages use JSON by default, or MessagePack for smaller binary messages.
Asked in interviews
AskedWhat is SignalR?gRPC
Define the service
greet.protoTurn it on and expose it
AddGrpc()MapGrpcService<T>() TrapBrowser apps must use gRPC-Web, which drops client and bidirectional streaming.
Asked in interviews
AskedWhat is gRPC and how can it be used in ASP.NET Core?Background tasks
Run a long loop
BackgroundService AddHostedService<T>() Stop on shutdownPass
stoppingToken to every awaited call.TrapAfter a crash, StopAsync may never run, so work held in memory is lost. Durable jobs need a persistent queue.
Asked in interviews
AskedHow do you implement background tasks in ASP.NET Core?Deploy, health & what's new
get it running and know what changedDeploy and health checks
Create a Web API and run it
dotnet new webapidotnet runBuild the publish folder
dotnet publishInclude the runtime
dotnet publish --self-containedPick a hostIIS, Linux with Nginx, Docker or Azure App Service.
Add a health endpoint
AddHealthChecks() MapHealthChecks(path) Split liveness and readinessTag the checks. Liveness decides a restart, readiness decides traffic.
TipA process manager restarts the app after a crash or a reboot.
TrapBehind a proxy, the app may not see the original scheme or client IP. Add Forwarded Headers middleware.
New in .NET 10
Name the main additionsMinimal API validation, OpenAPI 3.1 and passkey sign-in.
Send Server-Sent Events
TypedResults.ServerSentEvents Get 401 and 403 from a cookie APIKnown API endpoints return them instead of redirecting.
Tip.NET 10 is LTS, from November 2025.
Nothing matches. Try a shorter word, or clear the search.
Found this useful? Pass it on.
Pro · $10/mo
This sheet stays free. With Pro, you can:
- Every answer on this sheet. Read the full answer to all 67 questions it links, not just the 9 free ones.
- My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.
- PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.
- The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.