Interview Q&A

Short answer: dd claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value; dd claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new… Claim("Permission", "Edit") }; ccess… in… code: var claim = User.FindFirst("Permission")?.Value; dd…

Explain a bit more

claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value; dd claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new… Claim("Permission", "Edit") }; ccess in code: var claim = User.FindFirst("Permission")?.Value;

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Using Claims Claims are user attributes (e.g., email, role, permissions).

Explain a bit more

Add claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; Access in code: var claim = User.FindFirst("Permission")? is a common interview topic in ASP.NET Core. Give a clear definition, then one concrete example. Using Claims Claims are user attributes (e.g., email, role, permissions). Add claims when creating identity: var claims = new List<Claim> { new Claim(ClaimTypes.Name, user.UserName), new Claim("Permission", "Edit") }; Access in code: var claim = User.FindFirst("Permission")? is a common interview topic in ASP.NET Core. Give a clear definition, then one concrete example.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request. wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request. wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request. wait HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Used in traditional MVC apps for session-based auth. services.AddAuthentication(CookieAuthenticationDefaults.Authenticati onScheme) .AddCookie(options => { options.LoginPath = "/Account/Login"; }); On login: await HttpContext.SignInAsync(principal); Cookies are stored in the browser and sent with each request.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: lso supports: Facebook Microsoft Twitter OpenID Connect Azure AD Use RemoteAuthenticationHandler<T> or Identity scaffolding.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Use built-in providers: services.AddAuthentication() .AddGoogle(options => { options.ClientId = "..."; options.ClientSecret = "..."; }); Also supports: Facebook Microsoft Twitter OpenID Connect Azure AD Use RemoteAuthenticationHandler<T> or Identity scaffolding.

Example code

Use built-in providers: services.AddAuthentication() .AddGoogle(options => { options.ClientId = "...";
options.ClientSecret = "..."; }); Also supports: Facebook Microsoft Twitter OpenID Connect Azure AD Use RemoteAuthenticationHandler<T> or Identity scaffolding.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Used with JWT to renew access tokens after expiration without logging in again. Issue refresh token along with access token. Store securely (DB or secure HTTP-only cookie). On access token expiration, send refresh token to get a new one. You must manually implement refresh token logic (not built-in to Identity).

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: JWTs typically expire in 5–30 minutes. Expired tokens cannot be used. Revocation requires token blacklisting (e.g., database of revoked tokens). ✅ Configure expiration: Expires = DateTime.UtcNow.AddMinutes(30) ✅ Use refresh tokens to handle expiration.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: [Authorize]: Requires authenticated user [Authorize(Roles = "Admin")]: Requires role [AllowAnonymous]: Allows access without login

Example code

[Authorize] public IActionResult Dashboard() { } [AllowAnonymous] public IActionResult Login() { }

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthorizationHandler<MinimumAgeRequirement> { protected override Task HandleRequirementAsync(...) { // logic } } Register in DI and use with [Authorize(Policy = "...")].

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Define complex authorization rules using IAuthorizationHandler: public class MinimumAgeRequirement : IAuthorizationRequirement {

Example code

public int Age { get; }
public MinimumAgeRequirement(int age) => Age = age;
}
public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement> { protected override Task HandleRequirementAsync(...) { // logic }
} Register in DI and use with [Authorize(Policy = "...")].

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core uses Data Protection API to: Encrypt authentication cookies Protect tokens (e.g., password reset tokens) Configure: services.AddDataProtection() .PersistKeysToFileSystem(new DirectoryInfo("path")) .SetApplicationName("AppName"); Used internally by Identity and cookie middleware.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Multi-tenancy can involve: Per-tenant databases Per-tenant user stores Per-tenant roles/policies Strategies: Use claims to store tenant ID Filter data per tenant Custom middleware for tenant resolution Can integrate with IdentityServer4 or Azure AD B2C for federated auth.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ASP.NET Core Identity uses PBKDF2 hashing by default. Best practices: Never store plaintext passwords Use salted + hashed storage Use PasswordHasher<T> or Identity defaults Use: PasswordHasher<T>.HashPassword(user, password) Can switch to Argon2, Bcrypt via custom password hasher.

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Supported out of the box in ASP.NET Core Identity. Options: SMS (via provider) Email Authenticator app (TOTP) Enable via Identity configuration: services.Configure<IdentityOptions>(options => { options.SignIn.RequireConfirmedEmail = true; }); Use SignInManager<T> to handle verification and token generation. Filters & Middleware Overlaps

Real-world example (ShopNest)

A ShopNest checkout request flows through middleware, hits a minimal API or controller, uses scoped services, and returns ProblemDetails on errors.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters are components that run code before or after certain stages in the request pipeline within MVC or Razor Pages.

Explain a bit more

Types of filters include: Authorization filters: Run before any other filter to check user authorization. Resource filters: Run after authorization and before model binding. Action filters: Run before and after the execution of action methods. Exception filters: Handle unhandled exceptions thrown by actions. Result filters: Run before and after action results are executed. Filters allow you to inject logic at these specific points.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Middleware is part of the global HTTP request pipeline and executes for every request.

Explain a bit more

Filters only run within MVC/Razor pipeline, for controller actions or Razor Pages handlers. Middleware runs earlier and can short-circuit the entire pipeline; filters run later, scoped to MVC processing. Middleware is good for cross-cutting concerns affecting all requests, filters are better for concerns around controller/action execution.

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters run in a specific order depending on their type: Authorization filters run first.

Explain a bit more

Resource filters run next. Model binding happens after resource filters. Action filters run around the action execution. Exception filters handle exceptions thrown during action or result execution. Result filters run around result execution. Within each type, filters can be ordered by their Order property and whether they are global, controller-level, or action-level.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Create a custom filter by implementing one of the filter interfaces like: public class CustomActionFilter : IActionFilter

Example code

{
public void OnActionExecuting(ActionExecutingContext context)
{ // Before action executes }
public void OnActionExecuted(ActionExecutedContext context)
{ // After action executes }
} Register globally in Startup: services.AddControllersWithViews(options => { options.Filters.Add<CustomActionFilter>(); }); Or decorate controllers/actions: [ServiceFilter(typeof(CustomActionFilter))] public class HomeController : Controller { ... }

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: ctions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

Real-world example (ShopNest)

ShopNest registers AppDbContext as Scoped and IMemoryCache as Singleton. Putting DbContext in a Singleton causes threading bugs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Global filters apply to all MVC actions, registered via AddControllers or AddMvc options. Controller or action filters are applied via attributes directly on controllers or actions. Global filters are best for cross-cutting concerns like logging, exception handling. Controller/action filters are best for behavior specific to particular routes or endpoints.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters receive context objects (e.g., ActionExecutingContext) providing: HTTP context and request data. Access to action parameters. Ability to modify or cancel execution (e.g., short-circuit). Access to the result or exceptions. Ability to set result or modify response. This allows filters to inspect, modify, or block processing at their stage.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filters can short-circuit by setting the result early, preventing further execution: public void OnActionExecuting(ActionExecutingContext context)

Example code

{
if (!IsAuthorized())
{
context.Result = new UnauthorizedResult(); // stops pipeline here }
} This prevents action execution and later filters from running.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: Filter attributes are instantiated per request and support parameters, but have limited DI capabilities. Service-based filters (using ServiceFilter or TypeFilter) allow filters to be resolved from DI container, enabling constructor injection. Use service-based filters when you need dependencies injected.

Real-world example (ShopNest)

A ShopNest ValidateModelAttribute runs before actions and returns 400 if ModelState is invalid—same rule for every controller.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.

Short answer: uthentication). Use filters for MVC-specific concerns tied to action execution (authorization, validation, caching). Filters can complement middleware for granular control within MVC. Example: Use middleware for global exception logging, filters for handling MVC-specific exceptions and returning appropriate views or API responses. Versioning,… CORS

Real-world example (ShopNest)

ShopNest pipeline order matters: exception handling → HTTPS → auth → authorization → endpoints. Auth must run before protected APIs.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.