Explain the difference between app.Use(), app.Run(), and app.Map().
What is HttpContext in ASP.NET Core, and what kind of information does it expose during a request?
What is the difference between Middleware and Filters, and when would you use one over the other for cross-cutting concerns?
What does it mean for a middleware to short-circuit the pipeline, and when would you want this to happen?
What is the ASP.NET Core Middleware pipeline, and how does it differ from the old HttpModules and HttpHandlers?
How can you share data across different middleware components during a single request?
How do you short-circuit the middleware pipeline, and what is the behavior of app.Run() versus app.Use() and app.Map()?
What is Terminal Middleware, and where is it used in the pipeline?
What is the difference between inline and class-based middleware, and when is it better to encapsulate middleware in its own class?
Why is the order of middleware registration critical, and what are the consequences of placing UseRouting after UseAuthorization?
What is Endpoint Routing, and how does it allow middleware to be aware of the selected endpoint before it is executed?
Explain the difference between Transient, Scoped, and Singleton lifetimes. When would you use each?
What is the difference between GetRequiredService<T>() and GetService<T>()?
What are keyed services (introduced in .NET 8), and what problem do they solve?
What is the difference between Constructor Injection and Action Injection using the [FromServices] attribute?
What is the difference between IServiceCollection and IServiceProvider in the register vs. resolve phases of the application?
What is a captive dependency, how does it happen, and why is it dangerous for application stability?
How do you resolve a Scoped service inside a Background Service (IHostedService), and why can't you inject it directly into the constructor?
Why is it generally discouraged to use the 'Service Locator' pattern (IServiceProvider.GetService) inside a controller?
Hosting & Application Startup
What is the role of WebApplicationBuilder and WebApplication in the Minimal Hosting model?
How does the Program.cs file in .NET 6/7/8+ replace the legacy Startup.cs class?
What is Kestrel, and why is it recommended to use a reverse proxy (like IIS or Nginx) in front of it?
Explain the difference between the Generic Host and the Web Host in ASP.NET Core.
Explain the difference between the 'Generic Host' and the 'Minimal Hosting Model' introduced in .NET 6.
Routing Controllers & Action Results
What does the [ApiController] attribute do for a controller?
Explain the difference between Attribute Routing and Conventional Routing.
What are Action Results, and what is the difference between returning a specific type vs. IActionResult vs. ActionResult<T>?
What are the differences between Razor Pages and MVC controllers, and when would you choose one over the other?
Authentication & Authorization
What is the difference between Authentication and Authorization in the context of ASP.NET Core?
Explain Policy-based Authorization vs. Role-based Authorization, and when does a simple role check become insufficient?
What is the JWT Bearer flow, and how does the server validate a token without calling an external identity provider on every request?
Explain the concept of Claims-based Authorization versus Role-based Authorization.
What is ASP.NET Core Identity, and what features does it provide out of the box for user management?
How does cookie-based authentication work in ASP.NET Core, and how does it differ from JWT bearer authentication?
What are authorization requirements and handlers, and how do you implement a custom authorization policy with them?
How does ASP.NET Core support multiple authentication schemes, and how do you specify which scheme an endpoint uses?
How do you handle environment-specific configuration (Development vs. Production) in ASP.NET Core?
Explain the difference between IOptions, IOptionsSnapshot, and IOptionsMonitor and when you would use each.
How does the Configuration API work in ASP.NET Core, and what is the default order of precedence for configuration providers?
What is options validation, and why would you use ValidateOnStart()?
Why is the 'Options Pattern' preferred over injecting IConfiguration directly into your services?
When would you choose Minimal APIs over Controller-based APIs, and what are the trade-offs in ceremony, performance, and organization?
Can you use Filters with Minimal APIs? If not, what is the equivalent?
How do you handle Dependency Injection differently in Minimal APIs compared to Controllers?
How can you organize Minimal APIs in a large-scale project to avoid a massive Program.cs file?
What is the IResult/Results type in Minimal APIs, and how does it compare to IActionResult in MVC?
What is the difference between Response Caching and Output Caching, and which is client/proxy-based vs. server-side?
When would you use IMemoryCache versus IDistributedCache?
How does session state work in ASP.NET Core, and what are its dependencies on caching and cookies?
What is HybridCache (introduced in .NET 9), how does it differ from IDistributedCache, and how does it handle cache stampedes?
What is the purpose of the Antiforgery middleware, and how does it prevent CSRF attacks?
Explain how CORS (Cross-Origin Resource Sharing) is configured and enforced in ASP.NET Core.
What is the difference between HTTPS redirection and HSTS, and why are both used together?
How does the Data Protection API work in ASP.NET Core, and what is its role in protecting cookies and anti-forgery tokens in a load-balanced environment?
How does the static files middleware work, and how do you serve static content securely in ASP.NET Core?
What are Tag Helpers in Razor, and how do they differ from HTML Helpers?
What is a View Component, and how does it differ from a partial view?
How does localization and globalization work in ASP.NET Core, and what is the role of resource files and request culture providers?
Web API Features & Cross Cutting Concerns
What is Model Binding in ASP.NET Core, and how does it map HTTP request data to action parameters?
What is Swagger/OpenAPI, and how does ASP.NET Core generate API documentation from your endpoints?
What is WebApplicationFactory and why is it the standard for integration testing in ASP.NET Core?
What is Content Negotiation, and how does ASP.NET Core decide whether to return JSON or XML?
How does IHttpClientFactory help in managing the lifetime of HttpClient instances to avoid socket exhaustion?
What is the ProblemDetails (RFC 7807) standard, and how does ASP.NET Core support it for error responses?
How do you implement global exception handling in .NET 8+ using the IExceptionHandler interface?
What is the difference between IHostedService and BackgroundService for running background tasks?
How does SignalR handle real-time communication, and what are its transport fallbacks (WebSockets, Server-Sent Events, Long Polling)?
What are the different types of Filters (Authorization, Resource, Action, Exception, Result), and in what order do they execute?
What is a SignalR Hub, and how does it differ from a standard Controller?
What are Health Checks in ASP.NET Core and how do they integrate with orchestrators like Kubernetes?
What is model validation in ASP.NET Core, and how do data annotations and ModelState work together to validate incoming requests?
What are the different model binding source attributes ([FromBody], [FromQuery], [FromRoute], [FromForm], [FromHeader]), and when does each apply?
How does API versioning work in ASP.NET Core, and what strategies (URL, query string, header) can you use?
What is the difference between the Developer Exception Page and the UseExceptionHandler middleware, and when is each appropriate?
What are input and output formatters in ASP.NET Core, and how do they relate to content negotiation?
What are Log Scopes in the ASP.NET Core logging framework, and why are they useful for request tracing?
When should you use gRPC instead of REST for service-to-service communication in an ASP.NET Core ecosystem?
What is the rate limiting middleware in ASP.NET Core, and what algorithms (fixed window, sliding window, token bucket, concurrency) does it support?