Here are the top 80+ Entity Framework interview questions and answers for beginners and professionals.

Other Interview Questions – OOPs, C#, SQL, Web API

Basic Entity Framework Interview Questions & Answers

Download all Questions as .PDF

What is Entity Framework?

Entity Framework (EF) is an ORM (Object-Relational Mapper) for .NET. It allows you to interact with databases using C# code, instead of writing SQL queries.

Example:
If you have a Product class, EF can automatically create a table for it in the database and handle operations like adding, updating, or retrieving products without writing SQL code.

public class Product
{
    public int Id { get; set; }
    public string Name { get; set; }
    public decimal Price { get; set; }
} 

using (var context = new AppDbContext())
{
    var product = new Product { Name = "Laptop", Price = 1200.00M };
    context.Products.Add(product);
    context.SaveChanges();
} 

What are the main advantages of using Entity Framework?

The main advantages of using Entity Framework are:

1. Reduces SQL Code: Allows developers to focus on C# code without manually writing SQL.
2. Automates Database Operations: Handles CRUD operations automatically.
3. Simplifies Data Access: Provides an easier way to interact with databases using LINQ.
4. Change Tracking: Tracks object changes and updates the database accordingly.
5. Migration Support: Manages database schema changes with migrations.
6. Cross-Database Compatibility: Supports multiple database providers, like SQL Server, MySQL, and PostgreSQL.

Explain the difference between Database-First, Model-First, and Code-First approaches.

The three approaches in Entity Framework are:

• Database-First: The database is created first, and then EF generates classes based on the existing database schema.
  example: You have a database with tables, and EF generates C# models like ‘Customer’ and ‘Order’ from it.
• Model-First: You create a visual model using a designer, and EF generates the database and code based on that model.
  example: You use a diagram to design entities and relationships, then EF creates both the database tables and C# classes.
• Code-First: You write the C# classes first, and EF generates the database schema based on those classes.
  example: You create a ‘Product’ class in C#, and EF automatically generates the corresponding database table.

What is a DbContext in Entity Framework?

DbContext is the primary class for interacting with the database. It acts as a bridge between application and the database, managing the retrieval and saving of data.

Key responsibilities:

• Managing database connections
• Tracking changes to entities
• Executing queries and saving data

In simple terms, it’s the class you use to query and save data to the database.

public class AppDbContext : DbContext
{
    public DbSet<Product> Products { get; set; }
} 

What is the purpose of the DbContextOptions class?

The DbContextOptions class is used to configure how a DbContext should behave and interact with the database. It holds configuration options such as the database provider (SQL Server/ MySQL), connection string, logging & diagnostics, Other Options (like lazy loading, query tracking, and caching) and it passes these options to the DbContext.

public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }

    public DbSet<Product> Products { get; set; }
} 

var optionsBuilder = new DbContextOptionsBuilder<AppDbContext>();
optionsBuilder.UseSqlServer("YourConnectionString");

// Passing options to the DbContext
using (var context = new AppDbContext(optionsBuilder.Options))
{
    // Your database operations here
} 

What is a DbSet in Entity Framework?

A DbSet represents a collection of entities that you can query from and save to the database. It corresponds to a table in the database, and each entity in the DbSet is a row in that table.

For example, if you have a DbSet<Product>, it represents the Products table in the database.

public class AppDbContext : DbContext
{
    public DbSet<Product> Products { get; set; } // Products table
} 

How do you define a primary key in Entity Framework?

There are two way to define a Primary Key:

1. The Primary key is usually defined by creating a property named Id or <ClassName>Id in the entity class. EF will automatically treat this as the primary key.

public class Product
{
    public int Id { get; set; } // Primary Key
    //or
    public int ProductId { get; set; } // Primary Key

    public string Name { get; set; }
    public decimal Price { get; set; }
} 

2. If you want to explicitly define the primary key, you can use the [Key] attribute.

public class Product
{
    [Key]
    public int ProductId { get; set; } // Primary Key
    public string Name { get; set; }
} 

How can you configure a one-to-many relationship in Entity Framework?

A one-to-many relationship is configured by having one entity reference another entity (one side), and the other entity hold a collection of the first entity (many side).

Example: A Category can have many Products, but each Product belongs to one Category.

public class Category
{
    public int CategoryId { get; set; }
    public string Name { get; set; }

    // One-to-Many: A Category has many Products
    public List<Product> Products { get; set; } 
}

public class Product
{
    public int ProductId { get; set; }
    public string Name { get; set; }

    // Foreign Key: Product belongs to one Category
    public int CategoryId { get; set; }
    public Category Category { get; set; }
} 

What is the purpose of the OnModelCreating method in Entity Framework?

The OnModelCreating method in Entity Framework is used to configure the model and relationships between entities when the database is being created. It allows you to customize entity configurations that cannot be done through attributes.

It helps in fine-tuning how the entities are mapped to the database.

Common uses:

• Defining relationships (one-to-many, many-to-many)
• Setting up database schema rules (table names, column properties)
• Configuring keys, indexes, and constraints

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    // Example: Configuring a one-to-many relationship
    modelBuilder.Entity<Product>()
        .HasOne(p => p.Category)
        .WithMany(c => c.Products)
        .HasForeignKey(p => p.CategoryId);
} 

What is Lazy Loading in Entity Framework?

Lazy Loading in Entity Framework is a feature where related data is loaded from the database only when it is accessed for the first time, rather than loading it upfront with the main entity.

This helps improve performance by fetching data only when needed.

For example, if you load a ‘Product’ without accessing its related ‘Category’, the ‘Category’ data will not be loaded until you explicitly access it.

Lazy Loading can be enabled by making navigation properties virtual

public class Product
{
    public int ProductId { get; set; }
    public string Name { get; set; }

    // Lazy Loading: Related data is loaded only when accessed
    public virtual Category Category { get; set; }
} 

What is Eager Loading in Entity Framework?
What is the purpose of the Include method in EF?

Eager Loading or Include() method is a technique where related data is loaded from the database along with the main entity, in a single query. This is done to avoid multiple round-trips to the database.

By default, Entity Framework uses lazy loading, meaning related entities are only loaded when accessed.

Use the Include() method to specify which related data to load.

var products = context.Products
                      .Include(p => p.Category) // Eagerly loads related Category
                      .ToList(); 

What is Explicit Loading in Entity Framework?

Explicit Loading is a technique where you manually load related data after the main entity is already retrieved. It gives you full control over when to load the related data.

Unlike lazy loading, explicit loading doesn’t automatically load related data. You must explicitly tell Entity Framework to load it using the Load() method.

var product = context.Products.First(p => p.ProductId == 1);

// Manually load the related Category
context.Entry(product)
       .Reference(p => p.Category) // For a reference property
       .Load(); 

How does Entity Framework differ from ADO.NET?

What are Navigation Properties in Entity Framework?

Navigation Properties allows you to navigate and manage relationships between entities. They represent the associations between different entities (like one-to-many or many-to-many relationships) and enable easy access to related data.

For example: In a one-to-many relationship, a ‘Category’ can have multiple ‘Products’, and a ‘Product’ can belong to one ‘Category’.

public class Category
{
    public int CategoryId { get; set; }
    public string Name { get; set; }

    // Navigation Property (One-to-Many)
    public List<Product> Products { get; set; } 
}

public class Product
{
    public int ProductId { get; set; }
    public string Name { get; set; }

    // Navigation Property (Many-to-One)
    public Category Category { get; set; }
} 

How do you configure a many-to-many relationship in Entity Framework?

You can configure a many-to-many relationship by simply using navigation properties in both entities. EF Core automatically creates the join table and you need not to explicitly configure anything unless you want to customize it.

public class Student
{
    public int StudentId { get; set; }
    public string Name { get; set; }

    // Navigation property for the many-to-many relationship
    public List<Course> Courses { get; set; }
}

public class Course
{
    public int CourseId { get; set; }
    public string Title { get; set; }

    // Navigation property for the many-to-many relationship
    public List<Student> Students { get; set; }
} 

public class SchoolContext : DbContext
{
    public DbSet<Student> Students { get; set; }
    public DbSet<Course> Courses { get; set; }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<Student>()
            .HasMany(s => s.Courses)
            .WithMany(c => c.Students);
    }
} 

How can you enable and disable Lazy Loading in Entity Framework?

You can enable or disable Lazy Loading at both the context level and property level.

1. At Context Level: Lazy loading is disabled by default, you can enable it by calling UseLazyLoadingProxies() in Startup.cs
   ▼ Show example

   public class AppDbContext : DbContext
   {
       protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
       {
           optionsBuilder.UseLazyLoadingProxies(); // Enable Lazy Loading
       }
   } 

2. At the Property Level:
   • Enabling: Mark navigation properties as virtual to allow EF to override them with proxies for lazy loading.
     ▼ Show example

     public class Product
     {
         public int ProductId { get; set; }
         public string Name { get; set; }
     
         public int CategoryId { get; set; }
     
         // Enable lazy loading for this navigation property
         public virtual Category Category { get; set; } 
     } 

   • Disabling: Do not mark the navigation property as virtual if you want to disable lazy loading for a specific property.
     ▼ Show example

     public class Product
     {
         public int ProductId { get; set; }
         public string Name { get; set; }
     
         public int CategoryId { get; set; }
     
         // Disable lazy loading by omitting 'virtual'
         public Category Category { get; set; } 
     } 

What are Data Annotations in Entity Framework?

Data Annotations in Entity Framework are attributes you can apply to your model classes and properties to configure how they should be mapped to the database. These annotations allow you to control things like validation, relationships, and schema details directly within the code, without needing to configure these settings in the DbContext.

[Table("Products")]
public class Product
{
    [Key]
    public int ProductId { get; set; }
	
    [Column("Product_Name")]
    [Required]
    public string Name { get; set; }
	
    [MaxLength(100)]
    public string Name { get; set; }
	
    [StringLength(100, MinimumLength = 5)]
    public string Name { get; set; }
	
    public int CategoryId { get; set; }

    [ForeignKey("CategoryId")]
    public Category Category { get; set; }
	
    [ConcurrencyCheck]
    public string Name { get; set; }
	
    [Timestamp]
    public byte[] RowVersion { get; set; }	
} 

How do you handle concurrency in Entity Framework?

Concurrency conflicts occur when multiple users try to update the same data at the same time. To handle these conflicts, you can use optimistic concurrency control. Entity Framework provides mechanisms to detect and resolve these conflicts using Concurrency Tokens.

Ways to Handle Concurrency in Entity Framework:

1. Using a Timestamp/RowVersion Column:

A common approach is to add a Timestamp or RowVersion column to the entity. This column gets updated every time the record is modified, allowing Entity Framework to detect if someone else has updated the record between the time it was read and when an update is attempted.

public class Product
{
    public int ProductId { get; set; }
    public string Name { get; set; }

    // Timestamp for concurrency control
    [Timestamp]
    public byte[] RowVersion { get; set; }
} 

2. Handling Concurrency Conflicts:

To handle concurrency exceptions, you catch the DbUpdateConcurrencyException in your code and decide how to resolve the conflict.

try
{
    context.SaveChanges();
}
catch (DbUpdateConcurrencyException ex)
{
    foreach (var entry in ex.Entries)
    {
        if (entry.Entity is Product)
        {
            var proposedValues = entry.CurrentValues;
            var databaseValues = entry.GetDatabaseValues();

            // Decide how to handle the conflict
            if (databaseValues != null)
            {
                // For example, resolve by choosing the database values
                entry.OriginalValues.SetValues(databaseValues);
            }
        }
    }

    // Retry the save operation
    context.SaveChanges();
} 

3. Marking Properties for Concurrency:

You can also mark specific properties for concurrency tracking using the [ConcurrencyCheck] attribute.

public class Product
{
    public int ProductId { get; set; }

    [ConcurrencyCheck]
    public string Name { get; set; }
} 

What are Migrations in Entity Framework?

Migrations in Entity Framework are a way to manage and apply changes to your database schema over time, keeping it in sync with your model classes. When your model changes (like adding a new property, renaming a column, or creating a new table), migrations allow you to update the database schema without losing data.

Key Concepts of Migrations:

1. Tracking Changes: Migrations track changes made to your model (classes) and generate code to update the database accordingly.
2. Version Control: Each migration is like a version of your database schema, allowing you to move forward or roll back to previous versions.
3. Applying Changes: Migrations apply changes to the database using commands like Add-Migration and Update-Database.

How do you roll back a migration in Entity Framework?

You can revert the database schema to a previous state using the dotnet ef commands. Rolling back a migration removes the changes applied by that migration and updates the schema to a prior version.

You can use the following commands:

How can you seed data in Entity Framework?

Seeding data refers to the process of pre-populating the database with initial or default data. In EF Core, you can seed data during the migration process, ensuring that data is inserted when the database is first created or updated.

Steps to Seed Data in Entity Framework:

1. Override the OnModelCreating Method: You seed data by overriding the OnModelCreating method of your DbContext and using the HasData method to specify the data to be inserted.

public class AppDbContext : DbContext
{
    public DbSet<Product> Products { get; set; }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        // Seeding initial data
        modelBuilder.Entity<Product>().HasData(
            new Product { ProductId = 1, Name = "Laptop", Price = 1200 },
            new Product { ProductId = 2, Name = "Smartphone", Price = 800 }
        );
    }
}

public class Product
{
    public int ProductId { get; set; }
    public string Name { get; set; }
    public decimal Price { get; set; }
} 

2. Apply Migration with Seed Data: Once you’ve defined the seed data, you need to add a migration and update the database for the seeding to take effect.

This will insert the initial data into the Products table during migration.

Important Notes:

• HasData for Update: If the data already exists, HasData will not duplicate it. It only inserts new data.
• IDs are Required: For seeding to work, you must explicitly specify the primary key values (like ProductId in the example above).
• Migrations Only: Seeding through HasData works only during migration; if you use DropCreateDatabaseIfModelChanges, this seeding method doesn’t apply.

Seeding Related Entities: You can also seed related entities by specifying foreign keys.

modelBuilder.Entity<Category>().HasData(
    new Category { CategoryId = 1, Name = "Electronics" }
);

modelBuilder.Entity<Product>().HasData(
    new Product { ProductId = 1, Name = "Laptop", Price = 1200, CategoryId = 1 }
); 

Explain how Entity Framework handles transactions.

There are 3 ways to handle transactions in EF:

1. Automatic Transactions (Default): SaveChanges() is automatically wrapped in a transaction.
   When you call SaveChanges(), Entity Framework wraps all the changes in a transaction. If all the changes succeed, the transaction is committed. If any changes fail, the transaction is rolled back, ensuring that the database remains in a consistent state.
   ▼ Show example

   using (var context = new AppDbContext()) 
   {     
   	var product = new Product { 
   		Name = "Laptop", 
   		Price = 1200 
   	};     
   	context.Products.Add(product);     
   	context.SaveChanges();  // Automatically wrapped in a transaction 
   } 

2. Explicit Transactions: Use BeginTransaction() for manual control over transactions.
   If you need more control over the transaction (e.g., for multiple SaveChanges() calls or to handle complex scenarios), you can manage the transaction explicitly using the DbContextTransaction object.
   ▼ Show example

   using (var context = new AppDbContext()) 
   {     
   	using (var transaction = context.Database.BeginTransaction())     
   	{         
   		try         
   		{             
   			// First operation             
   			var product = new Product { Name = "Smartphone", Price = 800 };             
   			context.Products.Add(product);             
   			context.SaveChanges();  // First save within the transaction             
   			
   			// Second operation             
   			var category = new Category { Name = "Electronics" };             
   			context.Categories.Add(category);             
   			context.SaveChanges();  // Second save within the same transaction             
   			
   			// Commit transaction             
   			transaction.Commit();         
   		}         
   		catch (Exception)         
   		{             
   			// Rollback transaction if an error occurs             
   			transaction.Rollback();         
   		}     
   	} 
   } 

3. Transaction Scope: Use TransactionScope for handling distributed transactions across multiple contexts or databases.
   ▼ Show example

   using (var scope = new TransactionScope()) 
   {     
   	using (var context1 = new AppDbContext())     
   	{         
   		context1.Products.Add(new Product { Name = "Tablet", Price = 500 });         
   		context1.SaveChanges();     
   	}     
   	
   	using (var context2 = new AnotherDbContext())     
   	{         
   		context2.Orders.Add(new Order { OrderId = 1, Quantity = 2 });         
   		context2.SaveChanges();     
   	}     
   	
   	// Commit the transaction across both contexts     
   	scope.Complete(); 
   } 

What is ChangeTracker in EF?

The ChangeTracker is responsible for keeping track of the state of entities within the DbContext. It monitors changes made to the entities and determines what updates need to be sent to the database when SaveChanges() is called.

• It tracks the state of each entity (Added, Modified, Deleted, Unchanged, or Detached).
• This information is used to decide what operations (INSERT, UPDATE, DELETE) need to be performed in the database.
• You can enable or disable automatic change detection using the AutoDetectChangesEnabled property.
  
  context.ChangeTracker.AutoDetectChangesEnabled = false;
• You can access all tracked entities via ChangeTracker.Entries() to inspect their current state.
• You can use ChangeTracker for auditing purposes (e.g., to see what entities are being modified before saving changes) or for debugging entity state issues.

using (var context = new AppDbContext())
{
    var product = context.Products.Find(1);
    product.Name = "New Laptop Name";

    // Inspecting the entity state
    var state = context.Entry(product).State;  // Returns EntityState.Modified

    // Access all tracked entities
    var trackedEntities = context.ChangeTracker.Entries();

    context.SaveChanges();  // ChangeTracker detects changes and updates the database
} 

Advanced Entity Framework Interview Questions

What is the difference between AsNoTracking and AsTracking?

In Entity Framework, AsTracking and AsNoTracking control how entities are tracked by the ChangeTracker in the DbContext.

• AsTracking (Default Behavior): Entities are tracked by the DbContext for changes. When you query data with AsTracking, EF Core tracks the returned entities and keeps track of any modifications made to them. This allows you to update or delete the entities easily by calling SaveChanges(). Use AsTracking when you modify or delete the returned entities.
  ▼ Show example

  var product = context.Products.AsTracking().FirstOrDefault(p => p.ProductId == 1); 
  product.Name = "Updated Name"; 
  context.SaveChanges();  // The changes will be tracked and saved 

• AsNoTracking: Entities are not tracked by the DbContext. EF Core does not monitor any changes made to the entities, meaning it performs better in read-only scenarios where changes are not needed.
  ▼ Show example

  var product = context.Products.AsNoTracking().FirstOrDefault(p => p.ProductId == 1);
  product.Name = "Updated Name";
  context.SaveChanges();  // Changes will NOT be saved because the entity is not tracked

How do you perform raw SQL queries in Entity Framework?

Raw SQL queries can be executed directly on the database using methods like FromSql(or FromSqlRaw) for querying entities and ExecuteSql(ExecuteSqlRaw or ExecuteSqlCommand) for non-query operations such as inserts, updates, and deletes.

var products = context.Products
    .FromSqlRaw("SELECT * FROM Products WHERE Price > {0}", 1000)
    .ToList(); 

var productNames = context.Products
    .FromSqlRaw("SELECT Name FROM Products")
    .Select(p => p.Name)
    .ToList(); 

int rowsAffected = context.Database.ExecuteSqlRaw(
    "UPDATE Products SET Price = Price * 1.1 WHERE CategoryId = {0}", 1); 

What is a Complex Type in Entity Framework?

A Complex Type in Entity Framework is a class that does not have a primary key and cannot exist independently in the database. It is used to represent a group of related fields (properties) within an entity, but it doesn’t get its own table. Instead, the properties of the complex type are stored in the same table as the owning entity.

Characteristics of a Complex Type:

• No Primary Key: Unlike entities, complex types do not have a primary key and cannot be queried or tracked individually.
• Embedded in an Entity: Complex types are always part of another entity and cannot exist on their own.
• Reusability: You can reuse a complex type across multiple entities, encapsulating common properties.
• Stored in the Same Table: The properties of a complex type are mapped to columns in the same table as the entity it belongs to.

public class Address
{
    public string Street { get; set; }
    public string City { get; set; }
    public string State { get; set; }
    public string ZipCode { get; set; }
}

public class Customer
{
    public int CustomerId { get; set; }
    public string Name { get; set; }
    public Address Address { get; set; }  // Complex type used here
} 

public class AppDbContext : DbContext
{
    public DbSet<Customer> Customers { get; set; }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<Customer>()
            .OwnsOne(c => c.Address);  // Configuring Address as an owned type
    }
} 

How does Entity Framework support TPT, TPH, and TPC inheritance strategies?

Entity Framework (EF) supports three types of inheritance mapping strategies to model inheritance in relational databases: TPT (Table Per Type), TPH (Table Per Hierarchy), and TPC (Table Per Concrete Class). These strategies allow you to represent object-oriented inheritance in your data models while persisting them in relational databases.

1. TPH (Table Per Hierarchy):

In Table Per Hierarchy, all classes in an inheritance hierarchy are stored in a single database table. A discriminator column is used to distinguish between the different entity types.

Pros: Simple to implement. Better performance (single table query).
Cons: The table can become sparse (many NULL values) if the base and derived classes have many different properties.

public class Animal
{
    public int Id { get; set; }
    public string Name { get; set; }
}

public class Dog : Animal
{
    public string Breed { get; set; }
}

public class Cat : Animal
{
    public bool IsIndoor { get; set; }
} 

modelBuilder.Entity<Animal>()
            .HasDiscriminator<string>("Discriminator")
            .HasValue<Dog>("Dog")
            .HasValue<Cat>("Cat"); 

2. TPT (Table Per Type):

In Table Per Type, each class in the inheritance hierarchy has its own table in the database. The base class’s properties are stored in a base table, and each derived class has a separate table storing only the properties unique to that class.

Pros: No NULL values, as each class has its own table. Normalized table structure.
Cons: Requires JOINs when querying derived types, which can affect performance.

3. TPC (Table Per Concrete Class):

In Table Per Concrete Class, each concrete class (the base class and all derived classes) is mapped to its own table, containing all the properties of that class (including inherited properties). There is no table for the base class.

Pros: No joins are required since each class has its own table. Better performance when querying only derived types.
Cons: Data duplication: Properties inherited from the base class are duplicated in each derived class’s table. More storage space is required due to duplication.

How do you handle database connection strings in Entity Framework?

Here are common ways to manage connection strings in EF Core:

1. Storing Connection Strings in appsettings.json
   ▼ Show example
   
   

   This is a standard approach, where connection strings are stored in the appsettings.json file for easy configuration.

   example:

   {   
   	"ConnectionStrings": 
   		{     
   			"DefaultConnection": "Server=myServer;Database=myDB;User Id=myUser;Password=myPassword;"   
   		} 
   	} 

   
   

   Using in DbContext: You can retrieve the connection string in DbContext using dependency injection.

   public class AppDbContext : DbContext
   {
       public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }
   
       protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
       {
           if (!optionsBuilder.IsConfigured)
           {
               var connectionString = "YourConnectionStringHere";
               optionsBuilder.UseSqlServer(connectionString);
           }
       }
   } 

   
   
2. Accessing Connection Strings via Dependency Injection
   ▼ Show example
   
   

   Retrieve the connection string in Startup.cs and pass it to the DbContext.

   example:

   public class Startup
   {
       public IConfiguration Configuration { get; }
   
       public Startup(IConfiguration configuration)
       {
           Configuration = configuration;
       }
   
       public void ConfigureServices(IServiceCollection services)
       {
           services.AddDbContext<AppDbContext>(options =>
               options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
       }
   } 

   
   
3. Connection Strings for Multiple Environments: Use multiple appsettings.{Environment}.json files (e.g., appsettings.Development.json and appsettings.Production.json) for different configurations based on the environment.
4. Environment-Specific Configuration:
   ▼ Show example
   
   

   Using environment variables or secrets is useful in scenarios where sensitive information like passwords shouldn’t be stored in code.

   
   

   a. Environment Variables: Set the connection string as an environment variable, especially for production environments.

   export ConnectionStrings__DefaultConnection=”YourConnectionStringHere”

   
   

   b. User Secrets: For local development, use User Secrets to securely store the connection string outside of source control.

   dotnet user-secrets set “ConnectionStrings:DefaultConnection” “YourConnectionStringHere”

   
   

   Then, access it in appsettings.json:

   {
     "ConnectionStrings": {
       "DefaultConnection": "YourConnectionStringHere"
     }
   } 

   
   

How do you implement Soft Deletes?

Soft deletes allow you to mark an entity as deleted without actually removing it from the database. This approach helps preserve data history and supports data recovery.

Instead of deleting the entity, set the property value IsDeleted to true in your application code.

public void SoftDeleteProduct(int productId)
{
    var product = context.Products.Find(productId);
    if (product != null)
    {
        product.IsDeleted = true;
        context.SaveChanges();
    }
} 

Explain what the SaveChanges method does internally.

Detects changes, generates commands, executes them in a transaction, and updates Change Tracker.

Example – If you add, modify, or delete several Order and Customer entities and then call SaveChanges, EF Core will:

1. Detect which entities are new, modified, or deleted.
2. Generate the necessary INSERT, UPDATE, and DELETE commands.
3. Begin a transaction.
4. Execute the commands in the correct order.
5. Commit the transaction if all commands succeed or roll back if any command fails.
6. Update the Change Tracker to mark these changes as saved.

How can you log SQL queries generated by Entity Framework?

Entity Framework Core provides built-in support for logging SQL queries, making it easier to monitor or debug the SQL statements generated by your LINQ queries. Here’s how you can log SQL queries in different ways:

1. Using ILogger with Dependency Injection:

public class AppDbContext : DbContext
{
    private readonly ILoggerFactory _loggerFactory;

    public AppDbContext(DbContextOptions<AppDbContext> options, ILoggerFactory loggerFactory)
        : base(options)
    {
        _loggerFactory = loggerFactory;
    }

    protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
    {
        if (_loggerFactory != null)
        {
            optionsBuilder.UseLoggerFactory(_loggerFactory); // Enable logging
        }
    }
} 

public void ConfigureServices(IServiceCollection services)
{
    services.AddLogging(config => {
        config.AddConsole();
        config.SetMinimumLevel(LogLevel.Information); // Choose log level
    });

    services.AddDbContext<AppDbContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
} 

2. Using EnableSensitiveDataLogging: When logging queries, you may need to see parameter values. EF Core’s EnableSensitiveDataLogging method includes these values but should only be used in development, as it may expose sensitive data.

optionsBuilder
    .UseSqlServer("YourConnectionString")
    .EnableSensitiveDataLogging(); 

3. Using Application Insights (or Other External Loggers): If your application integrates with logging services like Application Insights or Serilog, you can capture EF Core logs there.

public void ConfigureServices(IServiceCollection services)
{
    services.AddLogging(config => {
        config.AddApplicationInsights("YourInstrumentationKey");
    });
} 

4. Console Logging (For Quick Setup): For simple applications, you can enable console logging directly when configuring the DbContext.

optionsBuilder
    .UseSqlServer("YourConnectionString")
    .LogTo(Console.WriteLine, LogLevel.Information); 

What is Shadow Property in Entity Framework Core?

A Shadow Property in Entity Framework Core is a property that exists only in the database, not in the .NET entity class, for example – “CreatedDate” column in the Database. EF creates and manages these properties and can be useful for storing data you don’t need directly in your entity model.

You can set or access shadow properties using Entry and Property methods.

public class AppDbContext : DbContext
{
    public DbSet<Product> Products { get; set; }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<Product>()
            .Property<DateTime>("CreatedDate");  // Define shadow property
    }
} 

public void AddProduct(Product product)
{
    context.Products.Add(product);
    context.Entry(product).Property("CreatedDate").CurrentValue = DateTime.Now;  // Set shadow property
    context.SaveChanges();
} 

What is Global Query Filter in Entity Framework Core?

A Global Query Filter is a filter applied to all queries for a specific entity type. It’s defined in OnModelCreating using the Fluent API and is commonly used for scenarios like soft deletes or multi-tenancy, where you want to filter out records based on a condition (e.g., IsDeleted = false).

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    modelBuilder.Entity<Product>().HasQueryFilter(p => !p.IsDeleted);
} 

How do you use a Composite Key in Entity Framework?

A Composite Key is defined when an entity requires multiple columns to identify a record uniquely. You can configure it using the Fluent API in the ‘OnModelCreating’ method.

public class OrderDetail
{
    public int OrderId { get; set; }
    public int ProductId { get; set; }
    public int Quantity { get; set; }
}

public class AppDbContext : DbContext
{
    public DbSet<OrderDetail> OrderDetails { get; set; }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<OrderDetail>()
            .HasKey(od => new { od.OrderId, od.ProductId });  // Define composite key
    }
} 

What is the purpose of the ModelBuilder class in EF?

The ModelBuilder class in Entity Framework is used to configure entity properties, relationships, and database mappings through the Fluent API. It’s typically used in the OnModelCreating method of DbContext to define table structures, keys, constraints, and other model configurations that are not set by default.

What are the differences between ‘FirstOrDefault’ and ‘SingleOrDefault’?

FirstOrDefault Vs SingleOrDefault

How do you detach an entity from the DbContext?

To detach an entity from the DbContext, use the Entry method combined with State property to set the state of the entity to Detached. Detaching an entity does not affect the database; it simply removes the entity from the context’s tracking.

You can also detach all entities if needed using context.ChangeTracker.Clear(), which detaches all entities being tracked by the context.

var product = context.Products.Find(productId);  // Retrieve the entity
context.Entry(product).State = EntityState.Detached;  // Detach the entity

What is the ‘Find’ method in Entity Framework, and how does it work?

The Find method in Entity Framework retrieves an entity by its primary key. It first checks the Change Tracker for a tracked entity; if found, it returns it without querying the database. If not, it performs a database query to fetch the entity. It returns the entity if found, or null if not.

var product = context.Products.Find(productId);

How do you use Stored Procedures with Entity Framework?

In EF, you can use stored procedures by executing raw SQL commands like FromSqlRaw to get records or ExecuteSqlRaw to insert data. EF Core allows mapping stored procedures to entity queries or using them for data modifications.

var categoryParam = new SqlParameter("Category", "Electronics");
var products = context.Products
    .FromSqlRaw("EXEC GetProductsByCategory @Category", categoryParam)
    .ToList(); 

context.Database.ExecuteSqlRaw("EXEC InsertProduct @Name, @Price", 
    new SqlParameter("Name", "Laptop"), 
    new SqlParameter("Price", 1200)); 

What is the difference between Remove and RemoveRange?

Remove: Deletes a single entity from the database. Use when you want to delete one specific entity.

RemoveRange: Deletes multiple entities at once. Accepts a collection of entities. Use when you want to delete multiple entities in a single operation for better performance.

// Remove a single entity
context.Products.Remove(product);

// Remove multiple entities
context.Products.RemoveRange(products); 

How do you handle exceptions in Entity Framework?

Use try-catch blocks to catch specific EF-related exceptions and handle them accordingly. Some common exception types include DbUpdateException, DbUpdateConcurrencyException, and SqlException (for SQL Server).

try
{
    context.SaveChanges();
}
catch (DbUpdateException ex)
{
    // Handle database update issues (e.g., foreign key violations)
    Console.WriteLine("Database update error: " + ex.Message);
}
catch (DbUpdateConcurrencyException ex)
{
    // Handle concurrency conflicts
    Console.WriteLine("Concurrency error: " + ex.Message);
}
catch (Exception ex)
{
    // Handle other exceptions
    Console.WriteLine("An error occurred: " + ex.Message);
} 

What is the difference between DbQuery and DbSet?

Differences between DbQuery and DbSet

Entity Framework with ASP.NET Core

How do you integrate Entity Framework Core with ASP.NET Core?

1. Install EF Core Packages
2. Define DbContext
3. Configure DbContext in Startup or Program
4. Add Connection String
5. Inject and Use DbContext in Controllers

public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }

    public DbSet<Product> Products { get; set; }
} 

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddDbContext<AppDbContext>(options =>
            options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
        
        services.AddControllers();  // Register MVC or API controllers
    }
} 

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=your_server;Database=your_db;User Id=your_user;Password=your_password;"
  }
} 

public class ProductsController : ControllerBase
{
    private readonly AppDbContext _context;

    public ProductsController(AppDbContext context)
    {
        _context = context;
    }

    [HttpGet]
    public async Task<ActionResult<IEnumerable<Product>>> GetProducts()
    {
        return await _context.Products.ToListAsync();
    }
} 

What is Dependency Injection, and how is it used with Entity Framework in ASP.NET Core?

Dependency Injection (DI) is a design pattern in which dependencies (e.g., services, configurations) are provided to a class rather than the class creating them itself. This promotes loose coupling and makes code easier to maintain and test. In ASP.NET Core, DI is built-in and widely used.

How It’s Used with Entity Framework in ASP.NET Core – Example: you can register your DbContext as a service and inject it where needed (e.g., in controllers or services).

public class ProductsController : ControllerBase
{
    private readonly AppDbContext _context;

    public ProductsController(AppDbContext context)
    {
        _context = context;
    }

    [HttpGet]
    public async Task<ActionResult<IEnumerable<Product>>> GetProducts()
    {
        return await _context.Products.ToListAsync();
    }
} 

How do you configure multiple DbContexts in an ASP.NET Core application?

To configure multiple DbContext classes in an ASP.NET Core application, register each DbContext with a unique configuration in ‘Startup.cs’. This allows you to connect to multiple databases or use different contexts for different parts of the application.

public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }
    public DbSet<Product> Products { get; set; }
}

public class LoggingDbContext : DbContext
{
    public LoggingDbContext(DbContextOptions<LoggingDbContext> options) : base(options) { }
    public DbSet<LogEntry> LogEntries { get; set; }
} 

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<AppDbContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("AppConnection")));
    
    services.AddDbContext<LoggingDbContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("LoggingConnection")));
    
    services.AddControllers();
} 

public class ProductsController : ControllerBase
{
    private readonly AppDbContext _appContext;

    public ProductsController(AppDbContext appContext)
    {
        _appContext = appContext;
    }
}

public class LogsController : ControllerBase
{
    private readonly LoggingDbContext _logContext;

    public LogsController(LoggingDbContext logContext)
    {
        _logContext = logContext;
    }
} 

How can you implement Unit of Work and Repository patterns with Entity Framework in ASP.NET Core?

To implement the Unit of Work and Repository patterns with Entity Framework in ASP.NET Core, you create repositories for data access operations and a Unit of Work class to coordinate multiple repositories, ensuring atomic operations within a single transaction.

Steps:

1. Create Repository Interface
2. Implement Repository Class
3. Create Unit of Work Interface
4. Implement Unit of Work Class
5. Register Unit of Work in Startup.cs
6. Use Unit of Work in a Controller

public interface IRepository<T> where T : class
{
    Task<IEnumerable<T>> GetAllAsync();
    Task<T> GetByIdAsync(int id);
    void Add(T entity);
    void Remove(T entity);
} 

public class Repository<T> : IRepository<T> where T : class
{
    private readonly AppDbContext _context;
    private readonly DbSet<T> _dbSet;

    public Repository(AppDbContext context)
    {
        _context = context;
        _dbSet = context.Set<T>();
    }

    public async Task<IEnumerable<T>> GetAllAsync() => await _dbSet.ToListAsync();
    public async Task<T> GetByIdAsync(int id) => await _dbSet.FindAsync(id);
    public void Add(T entity) => _dbSet.Add(entity);
    public void Remove(T entity) => _dbSet.Remove(entity);
} 

public interface IUnitOfWork
{
    IRepository<Product> Products { get; }
    IRepository<Order> Orders { get; }
    Task SaveAsync();
} 

public class UnitOfWork : IUnitOfWork
{
    private readonly AppDbContext _context;
    public IRepository<Product> Products { get; private set; }
    public IRepository<Order> Orders { get; private set; }

    public UnitOfWork(AppDbContext context)
    {
        _context = context;
        Products = new Repository<Product>(context);
        Orders = new Repository<Order>(context);
    }

    public async Task SaveAsync() => await _context.SaveChangesAsync();
} 

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<AppDbContext>(options => options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
    services.AddScoped<IUnitOfWork, UnitOfWork>();
    services.AddControllers();
} 

public class ProductsController : ControllerBase
{
    private readonly IUnitOfWork _unitOfWork;

    public ProductsController(IUnitOfWork unitOfWork)
    {
        _unitOfWork = unitOfWork;
    }

    public async Task<IActionResult> AddProduct(Product product)
    {
        _unitOfWork.Products.Add(product);
        await _unitOfWork.SaveAsync();
        return Ok();
    }
} 

How do you perform database seeding during application startup in ASP.NET Core?

To perform database seeding during application startup in ASP.NET Core, you can seed data directly within the DbContext or within the application’s startup logic. This approach populates the database with initial data if it’s empty or needs specific default values.

Steps to Seed Data on Startup:

1. Create Seed Method in DbContext: Populate default data if necessary.
2. Call Seed on Startup: Use CreateScope() to run the seeding method during app startup.
3. Optional Use of OnModelCreating: For static data, use HasData in OnModelCreating.

public class AppDbContext : DbContext
{
    public DbSet<Product> Products { get; set; }

    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }

    public void Seed()
    {
        if (!Products.Any())
        {
            Products.AddRange(
                new Product { Name = "Product1", Price = 100 },
                new Product { Name = "Product2", Price = 200 }
            );
            SaveChanges();
        }
    }
} 

public class Program
{
    public static void Main(string[] args)
    {
        var host = CreateHostBuilder(args).Build();
        SeedDatabase(host);
        host.Run();
    }

    private static void SeedDatabase(IHost host)
    {
        using (var scope = host.Services.CreateScope())
        {
            var services = scope.ServiceProvider;
            var context = services.GetRequiredService<AppDbContext>();

            context.Database.Migrate(); // Apply migrations
            context.Seed(); // Seed data
        }
    }

    public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>();
            });
} 

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    modelBuilder.Entity<Product>().HasData(
        new Product { Id = 1, Name = "Product1", Price = 100 },
        new Product { Id = 2, Name = "Product2", Price = 200 }
    );
} 

What are the best practices for managing DbContext lifetime in ASP.NET Core?

Here’s a concise list of best practices for managing DbContext lifetime in ASP.NET Core:

1. Use Scoped Lifetime (Default for DbContext): Register DbContext with a scoped lifetime (one instance per request).
2. Avoid Static Fields: DbContext isn’t thread-safe, so avoid using static/global variables.
3. Avoid Singleton Services: Don’t inject DbContext into Singleton services; use IServiceProvider if necessary.
4. Let DI Dispose Automatically: ASP.NET Core disposes DbContext automatically per request; avoid manual disposal.
5. Single Request Lifetime: Limit each DbContext instance to a single request for fresh data.
6. Separate Read/Write DbContexts (Optional): For high-traffic apps, use separate contexts for read and write operations.
7. Configure Connection Resiliency: For SQL Server, use EnableRetryOnFailure() to handle transient errors.
   

   services.AddDbContext<AppDbContext>(options => 
       options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"), 
       sqlOptions => sqlOptions.EnableRetryOnFailure())); 

8. Use AsNoTracking for Reads: For read-only queries, use AsNoTracking to boost performance by skipping change tracking.
   

   var products = await _context.Products.AsNoTracking().ToListAsync(); 

How can you use Entity Framework in a background service in ASP.NET Core?

To use Entity Framework in a background service in ASP.NET Core, inject the DbContext through a scoped dependency within the background service’s execution method. This ensures each background operation gets a fresh DbContext instance per execution cycle. This prevents DbContext lifetime issues in long-running services.

Use IServiceProvider.CreateScope() within ExecuteAsync to create a new scope.

public class MyBackgroundService : BackgroundService
{
    private readonly IServiceProvider _serviceProvider;

    public MyBackgroundService(IServiceProvider serviceProvider)
    {
        _serviceProvider = serviceProvider;
    }

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        while (!stoppingToken.IsCancellationRequested)
        {
            using (var scope = _serviceProvider.CreateScope())
            {
                var dbContext = scope.ServiceProvider.GetRequiredService<AppDbContext>();
                // Use dbContext to interact with the database
                var data = await dbContext.Items.ToListAsync(stoppingToken);
                // Process data
            }

            await Task.Delay(TimeSpan.FromMinutes(5), stoppingToken);
        }
    }
} 

services.AddHostedService<MyBackgroundService>();
services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"))); 

How do you handle connection resiliency with Entity Framework Core in ASP.NET Core?

Configuring EnableRetryOnFailure on the DbContext provides automatic retry logic for transient errors, improving connection resiliency in ASP.NET Core applications.

Steps:

1. Enable Retry Logic: Use the EnableRetryOnFailure option.
2. Customize Retry Policy: You can configure the maximum number of retries, delay between attempts, and specific error codes to retry, which are helpful for tuning resiliency based on your database and application needs.
3. Consider Idempotent Operations: For safe retries, ensure operations are idempotent (i.e., safe to retry without side effects) to avoid unintended consequences from repeated execution.

services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"), 
        sqlOptions => sqlOptions.EnableRetryOnFailure(
            maxRetryCount: 5, // Maximum retry attempts
            maxRetryDelay: TimeSpan.FromSeconds(10),  // Delay between retries
            errorNumbersToAdd: null))); // Additional SQL error codes to retry

Performance Tuning and Optimization – Q & A

How do you optimize the performance of queries in Entity Framework?

Short answer – Apply AsNoTracking, limit selected columns, use Include and Where efficiently, avoid early ToList, and consider compiled queries for frequently run operations. These techniques reduce memory usage and improve query speed.

In Detail: To optimize query performance in Entity Framework, use the following techniques:

1. Use ‘AsNoTracking’ for Read-Only Queries: Disables change tracking, reducing overhead for read-only operations.

   var customers = await context.Customers.AsNoTracking().ToListAsync(); 

2. Limit Data with ‘Select’: Retrieve only necessary columns instead of whole entities.

   var names = await context.Customers.Select(c => c.Name).ToListAsync(); 

3. Use ‘Include’ Wisely: Include related data only when necessary to avoid unnecessary joins.

   var orders = await context.Orders.Include(o => o.Customer).ToListAsync(); 

4. Filter Early with ‘Where’: Apply filtering at the database level to minimize data retrieval.

   var activeOrders = await context.Orders.Where(o => o.IsActive).ToListAsync(); 

5. Avoid ‘ToList’ Before Query Completion: Avoid calling ToList too early; chain queries to minimize data pulled into memory.

   var highValueOrders = await context.Orders
       .Where(o => o.TotalAmount > 1000)
       .ToListAsync(); 

6. Use Compiled Queries for Frequent Operations: Compiled queries are pre-optimized for reuse and are faster for repeated queries.

   private static readonly Func<AppDbContext, int, Task<Order>> GetOrderById =
       EF.CompileAsyncQuery((AppDbContext context, int orderId) => 
       context.Orders.Single(o => o.Id == orderId)); 

What is the purpose of ‘AsSplitQuery’ in Entity Framework Core?

AsSplitQuery in Entity Framework Core improves performance by splitting a single query with multiple Include statements into separate SQL queries. This prevents duplication (Cartesian explosion) in complex relationships, reduces memory usage, and can optimize query performance.

When to Use ‘AsSplitQuery’:

• When loading multiple related entities with Include statements (e.g., loading complex object graphs).
• When you notice performance degradation or excessive data being returned due to large joins.

var orders = await context.Orders
    .Include(o => o.Customer)
    .Include(o => o.OrderItems)
    .AsSplitQuery() // Executes multiple queries for each include
    .ToListAsync(); 

How can you reduce memory usage when using Entity Framework?

To reduce memory usage in Entity Framework, follow these practices:

1. Use ‘AsNoTracking’ for Read-Only Queries: Disables change tracking, saving memory for read-only data.

   var products = await context.Products.AsNoTracking().ToListAsync(); 

2. Limit Fetched Columns with ‘Select’: Retrieve only necessary columns to minimize data loading.

   var names = await context.Customers.Select(c => c.Name).ToListAsync(); 

3. Use ‘AsSplitQuery’ for Complex Queries: Splits large joins into multiple queries, reducing memory from duplicated data.

   var orders = await context.Orders
       .Include(o => o.Items)
       .AsSplitQuery()
       .ToListAsync(); 

4. Retrieve Data in Batches with ‘Take’: Load data in smaller chunks to avoid loading large datasets all at once.

   var batch = await context.Orders.Take(100).ToListAsync(); 

5. Dispose ‘DbContext’ Correctly: Use a new DbContext per operation to prevent memory leaks.

How does the ‘FromSqlRaw’ method differ from ‘FromSqlInterpolated’?

The FromSqlRaw and FromSqlInterpolated methods are used to execute raw SQL queries.

FromSqlRaw requires manual parameter passing, while FromSqlInterpolated handles parameters automatically in interpolated strings, reducing the risk of SQL injection.

1. FromSqlRaw: Executes a raw SQL query with parameters that must be explicitly passed to prevent SQL injection. Use this for predefined SQL strings.

var customers = context.Customers
    .FromSqlRaw("SELECT * FROM Customers WHERE City = {0}", city)
    .ToList(); 

2. FromSqlInterpolated: Executes an interpolated SQL query, where parameters are automatically handled within the interpolated string, making it easier and safer to use with inline variables.

var customers = context.Customers
    .FromSqlInterpolated($"SELECT * FROM Customers WHERE City = {city}")
    .ToList(); 

What is the purpose of the ‘BatchSize’ parameter in EF?

The BatchSize parameter in Entity Framework limits the number of commands sent in a single batch during SaveChanges. This improves performance in bulk operations by reducing database round-trips and helps avoid timeouts or memory issues.

optionsBuilder.UseSqlServer(connectionString, options => options.MaxBatchSize(100)); 

How do you handle large data sets in Entity Framework?

Use these strategies to handle large data sets in EF efficiently:

1. Paging with ‘Skip’ and ‘Take’: Load data in smaller, manageable chunks.

   var batch = await context.Items.Skip(0).Take(100).ToListAsync(); 

2. Use ‘AsNoTracking’ for Read-Only Data: Disables change tracking, reducing memory usage.

   var data = await context.LargeDataSet.AsNoTracking().ToListAsync(); 

3. Filter Early with ‘Where’: Apply filters to reduce the amount of data retrieved.

   var filteredData = await context.Items.Where(i => i.IsActive).ToListAsync(); 

4. Batch Processing for Bulk Operations: Use BatchSize to process data in batches, minimizing round-trips.

   optionsBuilder.UseSqlServer(connectionString, options => options.MaxBatchSize(100)); 

How does Entity Framework handle caching?

Entity Framework uses first-level caching by default, which caches entities within the scope of a single DbContext instance. When you query for an entity, EF checks the context cache first before querying the database. This helps reduce duplicate database calls within the same context.

using (var context = new AppDbContext())
{
    var product1 = await context.Products.FindAsync(1); // Database call
    var product2 = await context.Products.FindAsync(1); // Retrieved from cache (no DB call)
} 

What is ‘CompiledQuery’ in Entity Framework?

A CompiledQuery in Entity Framework is a pre-compiled LINQ query that improves performance by reusing the query execution plan. This is useful for queries that are frequently executed, as it avoids the overhead of re-compiling the query each time.

private static readonly Func<AppDbContext, int, Task<Product>> GetProductById =
    EF.CompileAsyncQuery((AppDbContext context, int id) => 
        context.Products.Single(p => p.Id == id));

var product = await GetProductById(context, 1); // Executes using the compiled query

How do you use a connection pool with Entity Framework?

Entity Framework Core uses connection pooling automatically when configured with a database provider that supports it (e.g., SQL Server). Connection pooling allows multiple DbContext instances to reuse connections, reducing the overhead of opening and closing database connections.

connection pooling is enabled by default, so simply configuring the connection string with DbContext automatically uses it:

services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer("YourConnectionString")); 

No additional configuration is needed to enable pooling; however, you can control pool size with certain providers if needed. Connection pooling improves performance by managing connection reuse internally.

How do you monitor and profile the performance of Entity Framework queries?

To monitor and profile the performance of Entity Framework queries, you can use the following methods:

• Enable Logging: Use ASP.NET Core’s built-in logging to capture SQL queries and execution details.

  services.AddDbContext<AppDbContext>(options =>
      options.UseSqlServer("YourConnectionString")
             .EnableSensitiveDataLogging() // Optional: shows parameter values
             .LogTo(Console.WriteLine));    // Logs to the console
  

• Use Microsoft.EntityFrameworkCore.Diagnostics Events: Monitor EF Core events for detailed query insights by subscribing to diagnostic events.
• Third-Party Profiling Tools: Tools like MiniProfiler, EF Core Profiler, or SQL Server Profiler provide detailed insights into query execution time, frequency, and optimization opportunities.
• Query Execution Plans: Review SQL execution plans in SQL Server Management Studio (SSMS) to understand how queries are processed and identify potential improvements.
• Performance Counters and Application Insights: For production environments, use Application Insights or performance counters to track EF Core performance and detect bottlenecks.

EF Core Features & Others – Q & A

What is the ‘HasQueryFilter’ method used for?

The HasQueryFilter method defines a global filter for entities, automatically applying a condition to all queries for that entity type. This is useful for soft deletes, multi-tenancy, and other scenarios requiring consistent filtering.

modelBuilder.Entity<Product>()
    .HasQueryFilter(p => !p.IsDeleted); 

How does EF Core support ‘spatial data’ types?

Spatial data types are specialized data types used to store geometric and geographic information, such as points, lines, and polygons, representing real-world locations. These data types are often used for mapping, geographic information systems (GIS), and location-based services.

Entity Framework Core supports spatial data types using NetTopologySuite, allowing storage and querying of geographic data like points and polygons.

services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer("YourConnectionString", sqlOptions =>
        sqlOptions.UseNetTopologySuite())); 

public class Location
{
    public int Id { get; set; }
    public Point Coordinates { get; set; } // Point is a spatial data type
} 

What is the ‘ToView’ method in Entity Framework Core?

The ToView method maps an entity to a database view rather than a table. It is used when you want to query a view but not allow modifications, as views are typically read-only in EF Core.

Example: If you have a view called ActiveProducts in your database, you can map it to an entity:

modelBuilder.Entity<Product>()
    .ToView("ActiveProducts"); 

Here, Product will be mapped to the ActiveProducts view, allowing you to run queries on it while preventing insert, update, or delete operations.

What is ‘Keyless Entity Type’ in EF Core?

A Keyless Entity Type is an entity that does not have a primary key. (Earlier it is called ‘Query Types’.) It’s useful for mapping database views, raw SQL queries, or other read-only data structures where a primary key isn’t needed.

public class SalesReport
{
    public string ProductName { get; set; }
    public int TotalSales { get; set; }
} 

modelBuilder.Entity<SalesReport>().HasNoKey(); 

How do you handle enum types in EF Core?

Entity Framework Core supports enum types by mapping them to their underlying integer values in the database. You can use enums directly in entity classes, and EF Core will handle conversion automatically.

public enum OrderStatus
{
    Pending,
    Shipped,
    Delivered
}

public class Order
{
    public int Id { get; set; }
    public OrderStatus Status { get; set; } // Enum property
} 

var Orders = context.Orders
			.Where(o => o.Status == OrderStatus.Shipped)
			.ToList(); 

What are Interceptors in EF Core, and how are they used?

Interceptors are components that allow you to intercept and modify operations like database commands, queries, and save actions before they are executed. They’re useful for logging, auditing, and custom validation.

public class MyCommandInterceptor : DbCommandInterceptor
{
    public override InterceptionResult<int> NonQueryExecuting(DbCommand command, CommandEventData eventData, InterceptionResult<int> result)
    {
        Console.WriteLine($"Executing Command: {command.CommandText}");
        return base.NonQueryExecuting(command, eventData, result);
    }
} 

protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
{
    optionsBuilder
        .AddInterceptors(new MyCommandInterceptor())
        .UseSqlServer("YourConnectionString");
} 

How do you use Value Conversions in EF Core?

Value Conversions in Entity Framework Core are used to convert property values between the entity and the database format, allowing you to store complex types, enums, or custom data formats as simpler database types.

public enum PriorityLevel
{
    Low,
    Medium,
    High
}

public class Task
{
    public int Id { get; set; }
    public PriorityLevel Priority { get; set; } // Enum property
} 

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    modelBuilder.Entity<Task>()
        .Property(t => t.Priority)
        .HasConversion<string>(); // Stores enum as string
} 

What are backing fields, and how are they used in EF Core?

Backing fields in Entity Framework Core are private fields used to store data for a property, typically when you want to control how the property is accessed or modified. They’re useful for encapsulation or when you need custom logic in getters and setters without exposing the underlying field directly.

public class Product
{
    private decimal _price;

    public int Id { get; set; }
    public decimal Price
    {
        get => _price;
        set => _price = value > 0 ? value : throw new ArgumentException("Price must be positive");
    }
} 

modelBuilder.Entity<Product>()
    .Property(p => p.Price)
    .HasField("_price"); 

How do you implement audit logging in Entity Framework?

To implement audit logging in Entity Framework, you can override the SaveChanges method to track changes and log them before they’re saved to the database. This is useful for recording data changes, timestamps, and users for audit purposes.

public class EntityBase
{
    public DateTime CreatedAt { get; set; }
    public DateTime? UpdatedAt { get; set; }
} 

public override int SaveChanges()
{
    var entries = ChangeTracker.Entries()
        .Where(e => e.Entity is EntityBase && (e.State == EntityState.Added || e.State == EntityState.Modified));

    foreach (var entry in entries)
    {
        var entity = (EntityBase)entry.Entity;
        entity.UpdatedAt = DateTime.Now;

        if (entry.State == EntityState.Added)
        {
            entity.CreatedAt = DateTime.Now;
        }
    }

    return base.SaveChanges();
} 

What are the security considerations when using Entity Framework?

The following are the key security considerations:

• SQL Injection Prevention: Use parameterized queries or LINQ to avoid SQL injection. Avoid concatenating raw SQL strings.

  var user = context.Users.FirstOrDefault(u => u.Username == username); 

• Sensitive Data Protection: Enable encryption for sensitive fields and use SecureString for in-memory sensitive data. Avoid exposing sensitive data in logs.
• Restricting Permissions: Limit database access permissions based on the principle of least privilege; only grant necessary CRUD operations.
• Proper Exception Handling: Catch and handle exceptions to avoid leaking sensitive error details in logs or UI responses.
• Use AsNoTracking: For read-only data, use ‘AsNoTracking()’ to prevent potential unintended modifications and reduce memory usage.

  var products = context.Products.AsNoTracking().ToList(); 

What is the ‘NoTracking’ query used for in EF?

A NoTracking query retrieves data without tracking changes to the entities, meaning Entity Framework won’t monitor or cache these objects. This improves performance and memory usage for read-only operations.

var products = context.Products.AsNoTracking().ToList(); 

How can you disable a migration in EF?

To disable a migration in Entity Framework, you can either remove it or skip applying it.

• Remove Migration: If the migration has not yet been applied to the database, use the Remove-Migration command in the Package Manager Console:
  Remove-Migration
• Skip Applying Migration: If the migration has already been applied, update the database to a previous migration, or delete it manually from the __EFMigrationsHistory table in the database. Then, remove the migration file from the project to avoid it being re-applied.

These methods prevent the migration from being applied or re-applied in future updates.

How do you test Entity Framework code?

To test Entity Framework code, you can use in-memory databases or a mocking framework to simulate a real database without persisting data.

Example – Using the InMemory provider allows testing of EF Core operations without a physical database:

var options = new DbContextOptionsBuilder<AppDbContext>()
    .UseInMemoryDatabase(databaseName: "TestDatabase")
    .Options;

using var context = new AppDbContext(options);
context.Products.Add(new Product { Name = "Test Product" });
context.SaveChanges();

var product = context.Products.FirstOrDefault();
Assert.Equal("Test Product", product.Name); 

UseInMemoryDatabase creates a temporary, in-memory database that can be used to test CRUD operations and EF Core logic. This approach is efficient for unit tests, as it avoids external dependencies.

How do you configure Entity Framework for SQL Server in a .NET Core application?

To configure Entity Framework for SQL Server in a .NET Core application, you use the UseSqlServer method in the DbContext configuration, typically in Startup.cs or in the Program.cs file.

dotnet add package Microsoft.EntityFrameworkCore.SqlServer 

services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer("YourConnectionString")); 

How do you implement custom conventions in Entity Framework?

To implement custom conventions in Entity Framework Core, you use the OnModelCreating method to define rules that apply to entity properties or configurations globally.

Example – To create a custom convention that adds a prefix to all table names:

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    foreach (var entity in modelBuilder.Model.GetEntityTypes())
    {
        entity.SetTableName("tbl_" + entity.GetTableName());
    }
} 

The custom convention prefixes each table name with “tbl_“. Custom conventions help enforce consistent rules across all entities without repetitive code.

What are the different lifecycle methods available in Entity Framework?

In Entity Framework, lifecycle methods allow you to customize behavior at various stages of the entity lifecycle. Key lifecycle methods include:

• OnModelCreating: Called when the model is being created, allowing configuration of entity relationships, conventions, and more.

  protected override void OnModelCreating(ModelBuilder modelBuilder)
  {
      // Configure entity properties, relationships
  } 

• SaveChanges / SaveChangesAsync: Called before data is saved to the database. You can override these to add custom logic, such as audit logging.

  public override int SaveChanges()
  {
      // Custom logic before saving
      return base.SaveChanges();
  } 

• OnConfiguring: Allows configuration of DbContext options, like specifying the database provider and connection string.

  protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
  {
      optionsBuilder.UseSqlServer("YourConnectionString");
  } 

How do you configure default schema in EF?

Specify OnModelCreating method in DbContext, this sets a default schema for all tables in the context.

Example – To set the schema to sales:

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    modelBuilder.HasDefaultSchema("sales");
} 

With this configuration, EF Core will create all tables under the sales schema unless overridden for individual entities.

What are the various logging providers available for Entity Framework Core?

Entity Framework Core supports several logging providers for capturing database operations and performance metrics. Common logging providers include:

1. Console Logger: Logs directly to the console, useful for development and debugging.

   optionsBuilder.UseSqlServer("YourConnectionString")
                 .LogTo(Console.WriteLine); 

2. Debug Logger: Logs to the Output window in Visual Studio, ideal for debugging.

   optionsBuilder.UseSqlServer("YourConnectionString")
                 .LogTo(Debug.WriteLine); 

3. Third-Party Providers: Supports popular logging frameworks like Serilog, NLog, and Log4Net by configuring them in Program.cs or Startup.cs.
4. Application Insights: Used for monitoring in production environments, especially in Azure-based applications.

How do you enforce a unique constraint in EF?

To enforce a unique constraint in Entity Framework Core, you use the HasIndex method with the IsUnique option in the OnModelCreating method.

Example – To enforce a unique constraint on the Email property of a User entity:

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    modelBuilder.Entity<User>()
        .HasIndex(u => u.Email)
        .IsUnique();
} 

How do you manage multi-tenancy with Entity Framework?

To manage multi-tenancy in Entity Framework Core, you typically use a global query filter to restrict data access by tenant ID. This approach filters records by a tenant identifier, allowing each tenant to only access their own data.

public class Order
{
    public int Id { get; set; }
    public int TenantId { get; set; }
    public string ProductName { get; set; }
} 

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    modelBuilder.Entity<Order>()
        .HasQueryFilter(o => o.TenantId == _currentTenantId);
} 

How do you migrate an existing application to EF Core?

To migrate an existing application to Entity Framework Core, you need to follow these main steps:

1. Install EF Core Packages: Add the EF Core packages specific to your database provider (e.g., Microsoft.EntityFrameworkCore.SqlServer).
   dotnet add package Microsoft.EntityFrameworkCore.SqlServer
2. Create a DbContext: Define a new DbContext class that represents your database and includes DbSets for each entity.

   public class AppDbContext : DbContext
   {
       public DbSet<Customer> Customers { get; set; }
       // other DbSets
   
       protected override void OnConfiguring(DbContextOptionsBuilder options)
       {
           options.UseSqlServer("YourConnectionString");
       }
   } 

3. Define Models: Create or update entity classes that match your existing database schema.
4. Run Initial Migration: Generate an initial migration based on your existing schema without applying it to the database.
   dotnet ef migrations add InitialMigration –context AppDbContext
5. Map Existing Tables: Use HasNoKey, HasColumnName, or HasTable in OnModelCreating to map entities to existing tables without modifying their structure.

What are the advantages and disadvantages of using Entity Framework?

Advantages:

• Productivity: Automates database operations, reducing manual SQL coding.
• Change Tracking: Automatically tracks entity changes, simplifying update processes.
• Database Independence: Supports multiple database providers, enabling easy switching.
• Automatic Migrations: Handles schema changes and data migrations efficiently.
• Strongly Typed: Provides compile-time validation for queries, reducing runtime errors.

Disadvantages:

• Performance Overhead: Slower than raw SQL for complex queries or large datasets.
• Less Control: Limited fine-tuning options compared to direct SQL, especially in complex queries.
• Learning Curve: Requires understanding of LINQ, EF configuration, and model relationships.
• Debugging Complexity: Issues can be harder to troubleshoot due to abstraction layers.
• Memory Usage: High memory usage with large datasets due to change tracking and caching.

What are some common pitfalls when using Entity Framework?

Here are some common pitfalls when using Entity Framework:

1. Unintended Lazy Loading: Lazy loading can result in many small queries (N+1 problem), impacting performance when loading related data.
2. Large Data Loads: Loading too much data at once can cause high memory usage and slow query performance.
3. Lack of AsNoTracking: Not using AsNoTracking for read-only queries can lead to unnecessary tracking, increasing memory usage.
4. Inefficient Queries: Complex LINQ queries may translate poorly to SQL, resulting in suboptimal database performance.
5. Ignoring Transactions: Entity Framework handles transactions by default, but complex operations may require explicit transaction management.
6. Overusing SaveChanges: Calling SaveChanges too frequently can result in multiple database trips; batch operations when possible.
7. Migrations Mismanagement: Incorrect migration handling can lead to schema drift or migration conflicts, especially in teams.
8. Not Handling Concurrency: Ignoring concurrency configurations may lead to data conflicts and unexpected overwrites in multi-user environments.

Avoiding these pitfalls can help maintain good performance, stability, and scalability when working with Entity Framework.

How can you optimize performance in Entity Framework?

To optimize performance in Entity Framework, consider these strategies:

1. Use AsNoTracking: For read-only queries, disable change tracking to reduce memory usage.
   
   var products = context.Products.AsNoTracking().ToList();
2. Limit Data with Projections: Select only required fields using .Select() to reduce data load.
   
   var productNames = context.Products.Select(p => p.Name).ToList();
3. Batch Operations: Minimize SaveChanges calls by batching multiple updates in a single transaction.
4. Eager Loading: Use .Include() to load related data in a single query rather than multiple queries.
   
   var orders = context.Orders.Include(o => o.Customer).ToList();
5. Use Compiled Queries: Pre-compile frequently used queries for faster execution, especially in EF Core.
6. Optimize Database Schema: Ensure indexes, foreign keys, and database normalization support EF queries efficiently.

Here are the top 80+ Web API interview questions and answers for beginners and professionals.

Other Interview Questions – OOPs, C#, SQL

Web API Interview Questions & Answers

Download all Questions as .PDF

What is Web API?

A Web API is a framework that allows you to build HTTP services that can be consumed by a broad range of clients, including browsers, mobile devices, and other servers. It is a core component of the ASP.NET framework and is often used to create RESTful services. In other words, a Web API is an Application Programming Interface for the Web.

What are the Key Concepts of Web API?

• HTTP Services: Web APIs are built on top of HTTP, which is the foundation of web communication. You can use the standard HTTP methods like GET, POST, PUT, DELETE to perform CRUD (Create, Read, Update, Delete) operations.
• RESTful Services: Web API is often used to create RESTful services. REST (Representational State Transfer) is an architectural style that uses HTTP methods to operate on resources identified by URLs. Web APIs expose endpoints (URLs) that correspond to these resources.
• Serialization: Data is typically exchanged in formats like JSON or XML. ASP.NET Web API provides out-of-the-box support for these formats, making it easy to serialize and deserialize data.
• Routing: ASP.NET Web API uses routing to map HTTP requests to the appropriate controller actions. The routing mechanism can be customized to meet the specific needs of your application.

Why Use Web API?

• Interoperability: Web API allows different clients (such as web browsers, mobile applications, or even other servers) to interact with your application, regardless of the platform or language they are built in.
• Lightweight: Unlike WCF (Windows Communication Foundation), which is more complex and suitable for service-oriented applications, Web API is lightweight and designed specifically for HTTP services. This makes it faster and more suitable for web-based scenarios.
• Scalability: Since Web API is stateless, it is highly scalable. Each request is independent of others, which is a key factor in building high-performance, scalable applications.
• Testability: Web APIs are easy to test. You can use tools like Postman or write unit tests to test the API endpoints without needing a user interface.
• Integration with .NET Core: ASP.NET Core Web API, the cross-platform version, allows you to build and deploy Web APIs that run on various operating systems, including Windows, Linux, and macOS.

What are some common use cases for Web API?

Common Use Cases for Web API:

• Single Page Applications (SPAs): Web APIs are often used as the backend services for SPAs built with frameworks like Angular, React, or Vue.js.
• Mobile Applications: Mobile apps commonly interact with a backend via Web APIs to fetch and update data.
• Microservices: In microservices architecture, each microservice might expose a Web API to communicate with other services or clients.

Explain the REST architectural style.

The REST (Representational State Transfer) architectural style is a set of principles for designing networked applications, particularly web services. REST is an architectural style, not a standard or protocol, and it is primarily used for designing APIs that can communicate over HTTP.

Key Principles of REST:

• Resource-Based: Resources are identified by URIs (Uniform Resource Identifiers). For example, ‘https://api.example.com/users/123’ might represent a user resource with the ID 123.
• Stateless Communication: RESTful services are stateless, meaning each HTTP request from a client to a server must contain all the information the server needs to fulfill that request. The server does not store any state information about the client session between requests or does not need to keep track of multiple client sessions.
• Standard HTTP Methods (verbs): perform operations on resources – Get, Post, Put, Delete, Patch.
• Representation of Resources: Resources can have multiple representations, such as JSON, XML, or HTML, depending on what the client requests and what the server can provide. This is handled via content negotiation (using the Accept header in HTTP).
• Uniform Interface: REST promotes a uniform interface between clients and servers and this uniformity is achieved through consistent use of URIs, HTTP methods, headers, and status codes.
• Layered System: The client may not know whether it is communicating with the end server or an intermediary (such as a load balancer or a cache).
• Cacheable: Responses from RESTful services should explicitly indicate whether they are cacheable or not, using appropriate HTTP headers. Caching improves performance by reducing the number of client-server interactions.
• Client-Server Architecture: REST is based on a client-server architecture where the client and server have distinct responsibilities. The client handles the user interface, and the server manages and processes the resources. This separation of concerns allows for independent development and scaling of the client and server components.

What are the advantages of REST?

• Scalability: Because of its stateless nature, REST APIs can easily scale to handle a large number of clients.
• Performance: RESTful services can be made more performant by leveraging caching mechanisms.
• Flexibility: REST APIs can interact with different types of clients, including web browsers, mobile applications, and IoT devices, without needing client-specific adaptations.
• Interoperability: RESTful services can be consumed by different clients written in various programming languages, making it a highly interoperable architecture.

What is a RESTful service, and how does it relate to Web API?

A RESTful service is an application that follows the principles of Representational State Transfer (REST), which is an architectural style for designing networked applications. It uses standard HTTP methods (GET, POST, PUT, DELETE) to perform CRUD (Create, Read, Update, Delete) operations on resources, which are typically represented by URLs.

In the context of Web API, a RESTful service is implemented using ASP.NET Web API to create HTTP-based services that are accessible via the web, allowing different clients (browsers, mobile apps, etc.) to interact with the server-side resources in a stateless manner.

What is the difference between REST and SOAP in the context of Web APIs?

REST is ideal for simpler, stateless, and scalable web services with lightweight communication, commonly using JSON.

SOAP is better suited for enterprise-level services requiring strict standards, security, and ACID transactions, using XML.

What are different standard HTTP methods?

In RESTful APIs, standard HTTP methods (also known as HTTP verbs) are used to perform operations or specific actions on resources. and they follow the CRUD (Create, Read, Update, Delete) pattern.

Here are the main HTTP methods:

• GET: Retrieve data.
• POST: Create a new resource.
• PUT: Update or create a resource.
• DELETE: Remove a resource.
• PATCH: Apply partial updates.
• OPTIONS: Discover available methods.
• HEAD: Retrieve headers without the body.

What is the difference between [HttpGet], [HttpPost], [HttpPut], and [HttpDelete] attributes?

public IActionResult GetItem(int id) 

public IActionResult CreateItem([FromBody] Item item) 

public IActionResult UpdateItem(int id, [FromBody] Item item) 

public IActionResult DeleteItem(int id) 

What are the differences between PUT and PATCH?

What is CRUD? What is the syntax for CRUD operations in Web API?

CRUD stands for Create, Read, Update, and Delete. These are the four basic operations that can be performed on data in a database or any persistent storage system.

• Create: Adding new data or records to a database (e.g., adding a new user).
• Read: Retrieving or reading data from the database (e.g., fetching user details).
• Update: Modifying existing data or records in the database (e.g., updating user information).
• Delete: Removing data or records from the database (e.g., deleting a user account).

// Create (POST)
[HttpPost]
public IActionResult Create([FromBody] Product product)
{
    // Add new product to the database
    return CreatedAtAction(nameof(GetById), new { id = product.Id }, product);
}

// Read (GET)
[HttpGet("{id}")]  // ../Product/5
public IActionResult GetById(int id)
{
    // Retrieve product by id from the database
    var product = _context.Products.Find(id);
    if (product == null)
    {
        return NotFound();
    }
    return Ok(product);
}

// Update (PUT)
[HttpPut("{id}")]
public IActionResult Update(int id, [FromBody] Product product)
{
    if (id != product.Id)
    {
        return BadRequest();
    }
    
    // Update existing product in the database
    _context.Entry(product).State = EntityState.Modified;
    _context.SaveChanges();
    
    return NoContent();
}

// Delete (DELETE)
[HttpDelete("{id}")]
public IActionResult Delete(int id)
{
    var product = _context.Products.Find(id);
    if (product == null)
    {
        return NotFound();
    }
    
    // Remove product from the database
    _context.Products.Remove(product);
    _context.SaveChanges();
    
    return NoContent();
} 

// ../Product/GetAllSales
[HttpGet("GetAllSales")]
public IActionResult GetAllSales()
{
    // ....
}

// ../Product/Pairing/33
[HttpGet("Pairing/{level3Id}")]
public IActionResult GetPairings(int level3Id)
{
    // ....
}


/* QueryString Example*/
// ../Product/2?version=111
[HttpGet("ListFiles/{level3Id}")]
public IActionResult ListFiles(int level3Id, string queryStringParam)
{
    // ....
} 

What default Structure do you see once a new Web API project is created in .NET?

Once the project is created, you’ll see the following structure:

• Controllers: This folder contains your API controllers, where each controller defines endpoints.
• Program.cs: The entry point of your application where the application is configured.
• appsettings.json: Configuration file for your application settings.
• Startup.cs: (For older .NET Core versions) Contains configuration and services setup.
• Properties/launchSettings.json: Contains settings for debugging and launching your application.

What are Controllers and Actions in Web API?

Controllers are classes that handle incoming HTTP requests. They group related actions together, usually focused on a specific resource (like “Products” or “Users”).

Actions are methods within controllers that process specific requests. Each action corresponds to an HTTP request type (like GET, POST, PUT, DELETE) and performs operations like retrieving data, creating new entries, or updating records.

[ApiController]
[Route("api/[controller]")]
public class MyController : ControllerBase
{
     // Action Method
    [HttpGet]
    public IActionResult Get()
    {
        return Ok(new { Message = "Hello, World!" });
    }
} 

What is Routing in Web API?

Routing in a Web API is the mechanism that maps incoming HTTP requests to specific action methods in a controller. It determines how the requests are processed and which actions should handle them based on the URL, HTTP method (GET, POST, PUT, DELETE, etc.), and other route data.

Types of routing in Web API

In a Web API, there are two main types of routing:

1) Attribute-Based Routing: Routes are defined directly on the controller and action methods using attributes like [HttpGet], [HttpPost], etc. Provides more control over the routes, allowing for customized and complex URL structures.

[Route("api/products")]
public class ProductsController : ControllerBase
{
    [HttpGet("{id}")]
    public IActionResult GetProduct(int id) { ... }
} 

2) Conventional Routing: Routes are defined globally in a central place, typically in the Program.cs or Startup.cs file, using a pattern that applies to all controllers (for older versions of ASP.NET Core). Best for simpler applications where all controllers follow a consistent or standard URL structure.

app.UseEndpoints(endpoints =>
{
    endpoints.MapControllerRoute(
        name: "default",
        pattern: "api/{controller}/{action}/{id?}");
}); 

What is Route Prefix?

Route Prefix is a common route path applied to all routes within a controller, allowing you to avoid repeating the same base path for each action method.

You can apply a common prefix to multiple routes using the [Route] attribute at the controller level.

[Route("api/products")]
public class ProductsController : ControllerBase
{
    [HttpGet]
    public IActionResult GetAllProducts()
    { .... }

    [HttpGet("{id}")]
    public IActionResult GetProductById(int id)
    { .... }
} 

What is Route Constraint in Web API?

Route constraints are rules that restrict route parameters to specific types or patterns, like requiring an integer ({id:int}) or a specific format, ensuring valid data is passed to action methods.

You can specify parameters in routes and apply constraints to them.

[HttpGet("products/{categoryId:int}/items/{itemId:int}")]
public IActionResult GetItemByCategory(int categoryId, int itemId)
{
    return Ok($"Category ID: {categoryId}, Item ID: {itemId}");
} 

How do you use Route Naming in Web API, and why is it useful?

Route naming allows you to assign a name to a route, which you can use to generate URLs dynamically within your application. Route names are useful for generating links, so that you can include a link in an HTTP response. To specify the route name, set the Name property on the attribute.

[HttpGet("{id}", Name = "GetProductById")]
public IActionResult GetProductById(int id)
{
    return Ok($"Product {id}");
}

[HttpPost]
public IActionResult CreateProduct([FromBody] string product)
{
    return CreatedAtRoute("GetProductById", new { id = 1 }, product);
} 

Difference Between Created, CreatedAtAction and CreatedAtRoute

Created, CreatedAtAction, and CreatedAtRoute are methods used to return a response indicating that a resource has been successfully created. They differ in how they specify the location (URI) of the newly created resource.

• Created: Returns a 201 Created status code with a Location header containing the URI of the created resource. Use when you already know the exact URI of the newly created resource.
  ▼ Show example

  public IActionResult CreateProduct([FromBody] Product product)
  {
      var uri = $"api/products/{product.Id}";
      return Created(uri, product);
  } 

• CreatedAtAction: Returns a 201 Created status code and automatically generates the Location header based on a specific action. Use when you want the framework to generate the URI for the newly created resource based on a specified action method in the current or another controller.
  ▼ Show example

  public IActionResult CreateProduct([FromBody] Product product)
  {
      return CreatedAtAction(nameof(GetProductById), new { id = product.Id }, product);
  }
  
  public IActionResult GetProductById(int id)
  {
      // Retrieve and return product by id
  } 

• CreatedAtRoute: Returns a 201 Created status code and automatically generates the Location header based on a named route. Use when you want the framework to generate the URI for the newly created resource based on a named route.
  ▼ Show example

  public IActionResult CreateProduct([FromBody] Product product)
  {
      return CreatedAtRoute("GetProductByIdRoute", new { id = product.Id }, product);
  }
  
  [HttpGet("{id}", Name = "GetProductByIdRoute")]
  public IActionResult GetProductById(int id)
  {
      // Retrieve and return product by id
  } 

How do you handle URL parameters in Web API?

URL parameters (also known as route parameters) can be handled by defining them in the route template and binding them to method parameters in your controller. Here’s how you can handle URL parameters:

1. URL Parameters in Route Template:
   ▼ Show example

   
   

   1) Single URL Parameters in Route Template:

   [HttpGet("{id}")]
   public IActionResult GetProduct(int id)
   {
   } 

   URL Request: /api/products/5

   
   
   

   2) Multiple URL Parameters in Route Template:

   [HttpGet("{category}/{id}")]
   public IActionResult GetProductByCategory(string category, int id)
   {
   } 

   URL Request: /api/products/electronics/5
2. Optional URL Parameters:
   ▼ Show example

   [HttpGet("{id?}")]
   public IActionResult GetProduct(int? id)
   {
   	// assign default value if id is null.
   } 

   URL Request:
   1) with parameter: /api/products/5
   2) without parameter: /api/products
3. Query String Parameters:
   ▼ Show example

   [HttpGet("search")]
   public IActionResult SearchProducts([FromQuery] string name)
   {
   } 

   URL Request: /api/products/search?name=phone

How do you handle multiple versions of a Web API?

Handling multiple versions of a Web API is essential when you need to support different versions of your API while maintaining backward compatibility for existing clients.

Common Versioning Strategies:

1. URI Path Versioning: The version number is included in the URL path of the API endpoint.

   GET /api/v1/products
   GET /api/v2/products 

   Advantages: Clear and easy to understand. Makes it straightforward to manage multiple versions.
   Disadvantages: Can lead to duplication of routes. Less flexible if versioning requirements become complex.
2. Query String Versioning: The version number is passed as a query string parameter in the API request.

   GET /api/products?version=1
   GET /api/products?version=2 

   Advantages: Keeps the URI structure clean.
   Disadvantages: Can be less discoverable or intuitive for clients. May be overlooked in caching mechanisms.
3. Header Versioning: The version number is specified in the HTTP headers of the request.

   GET /api/products
   Headers: API-Version: 1 

   Advantages: Separates versioning information from the URI. Allows the URI to remain clean and consistent.
   Disadvantages: Not immediately visible in the URI. Clients need to be aware of the correct headers to use.
4. Namespace Versioning: Different versions of the API are separated by using different namespaces in the codebase.

   Version 1 Controller: Controllers.V1.ProductsController
   Version 2 Controller: Controllers.V2.ProductsController 

   Advantages: Clean organization of code.
   Disadvantages: Can lead to duplicated code if not managed properly.
5. Accept Header Versioning (Media Type Versioning): The version is specified in the Accept header as part of the media type.

   GET /api/products
   Headers: Accept: application/vnd.yourapi.v1+json 

   Advantages: Clean URI. Allows for content negotiation.
   Disadvantages: Complex for clients to understand and implement. Less intuitive.

services.AddApiVersioning(options =>
{
    options.DefaultApiVersion = new ApiVersion(1, 0);
    options.AssumeDefaultVersionWhenUnspecified = true;
    options.ReportApiVersions = true;
    options.ApiVersionReader = new UrlSegmentApiVersionReader(); // or QueryStringApiVersionReader(), HeaderApiVersionReader()
}); 

[ApiVersion("1.0")]
[Route("api/v{version:apiVersion}/products")]
[ApiController]
public class ProductsV1Controller : ControllerBase
{
    [HttpGet]
    public IActionResult Get() => Ok("Version 1");
}

[ApiVersion("2.0")]
[Route("api/v{version:apiVersion}/products")]
[ApiController]
public class ProductsV2Controller : ControllerBase
{
    [HttpGet]
    public IActionResult Get() => Ok("Version 2");
} 

[ApiVersion("1.0")]
[Route("api/products")]
[ApiController]
public class ProductsController : ControllerBase
{
    [HttpGet]
    public IActionResult GetV1() => Ok("Version 1");

    [HttpGet, MapToApiVersion("2.0")]
    public IActionResult GetV2() => Ok("Version 2");
} 

Explain the use of IHttpActionResult in returning HTTP responses.

IHttpActionResult is an interface that simplifies the process of creating HTTP responses. It provides a clean and standardized way to return responses from API actions. It provides built-in methods to generate common HTTP responses (e.g., Ok, BadRequest) and this reduces the need to manually create HttpResponseMessage objects.

Common ‘IHttpActionResult’ Methods:

• Ok(): Returns a 200 OK response.
• BadRequest(): Returns a 400 Bad Request response.
• NotFound(): Returns a 404 Not Found response.
• Created(): Returns a 201 Created response with a URI to the newly created resource.
• Unauthorized(): Returns a 401 Unauthorized response.

What is Middleware?

Middleware is a fundamental concept where various components are assembled into a pipeline to handle HTTP requests and responses. Each middleware component can perform operations before & after the next component in the pipeline is invoked and can handle tasks like logging, authentication, and error handling, and can either pass control to the next component or short-circuit the pipeline by returning a response directly. Middleware components are executed in the order they are registered in the Startup.cs file (Configure method).

public class Startup
{
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            // ....
        }

        app.UseHttpsRedirection(); // Redirect HTTP requests to HTTPS
        app.UseRouting(); // Middleware to route requests

        app.UseAuthentication(); // Middleware to handle authentication
        app.UseAuthorization();  // Middleware to handle authorization

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers(); // Middleware to map controllers
        });
    }
} 

How to Create Custom Middleware?

You can create custom middleware to handle specific tasks within the request pipeline. Creating custom middleware in ASP.NET Core Web API allows you to add custom processing logic to the HTTP request and response pipeline. Custom middleware can be used for tasks such as logging, request modification, response handling, or even custom authentication mechanisms.

Steps to Create Custom Middleware:

• Create a Custom Middleware Class: The custom middleware class needs to have a constructor that takes a RequestDelegate parameter and an Invoke or InvokeAsync method that processes the HTTP context.
▼ Show example

public class CustomMiddleware
{
    private readonly RequestDelegate _next;

    public CustomMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // Pre-processing logic before passing to the next middleware
        Console.WriteLine($"Request Path: {context.Request.Path}");

        // Call the next middleware in the pipeline
        await _next(context);

        // Post-processing logic after the next middleware has run
        Console.WriteLine($"Response Status Code: {context.Response.StatusCode}");
    }
} 

• Register the Custom Middleware in the Request Pipeline: To use your custom middleware, you need to register it in the pipeline using the UseMiddleware extension method in the Startup.cs or Program.cs file.
▼ Show example

public class Startup
{
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        // Register the custom middleware
        app.UseMiddleware<CustomMiddleware>();

        // Other middleware registrations
        app.UseRouting();

        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
} 

(Optional) Middleware as an Extension Method: You can create an extension method to simplify the registration of your custom middleware, making it more reusable and easier to configure.

public static class CustomMiddlewareExtensions
{
    public static IApplicationBuilder UseCustomMiddleware(this IApplicationBuilder builder)
    {
        return builder.UseMiddleware<CustomMiddleware>();
    }
}

// Register using the extension method
public class Startup
{
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        // Register the custom middleware using the extension method
        app.UseCustomMiddleware();

        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
} 

In what order are middleware components executed?

Middleware components execute the request in the order they are registered in the Startup.cs file in the Configure method. It’s important to add middleware in the correct order; otherwise, the application might not work properly. This order is crucial for ensuring security, performance, and proper functionality.

public class Startup
{
    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseExceptionHandler();
        app.UseHsts();
        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy();
        app.UseRouting();
        app.UseCors();
        app.UseAuthentication();
        app.UseAuthorization();
        app.UseSession();
        app.UseMiddleware<CustomMiddleware>();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });

    }
} 

The following diagram shows the complete request processing pipeline.

What is Data Annotation?

Data Annotations are a set of attributes that you can apply to model properties or classes to enforce validation rules, specify formatting, and control how data is displayed. It ensures that the data received by API is correct and follows the rules.

Data Annotations are commonly used to validate user input like ‘required field’ validation and to specify metadata about a model such as display names, descriptions, or format strings. It allows you to apply validation and metadata directly in the model class.

Common Data Annotation Attributes:

using System.ComponentModel.DataAnnotations;

public class Product
{
	[Required(ErrorMessage = "Product ID is required")]
	[Display(Name = "Product ID")]
	[Key]
	public int Id { get; set; }

	[StringLength(100, ErrorMessage = "Product name cannot exceed 100 characters")]
	public string Name { get; set; }

	[Range(0.01, 10000, ErrorMessage = "Price must be between 0.01 and 10,000")]
	public decimal Price { get; set; }

	[EmailAddress(ErrorMessage = "Invalid email address format")]
	public string SupplierEmail { get; set; }

	[MinLength(3, ErrorMessage = "Product Code must be at least 3 characters long")]
	public string ProductCode { get; set; }

	[MaxLength(100, ErrorMessage = "Title cannot exceed 100 characters")]
	public string Title { get; set; }

	[Phone(ErrorMessage = "Please enter a valid phone number")]
	public string PhoneNumber { get; set; }

	[RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Only letters are allowed")]
	public string SupplierName { get; set; }

	[Url(ErrorMessage = "Please enter a valid URL")]
	public string Website { get; set; }

} 

What are HTTP response methods?

HTTP response methods are built-in methods used to generate and return specific HTTP status codes and messages in response to client requests. You can use various HTTP response methods to indicate the outcome of an API request. Each method corresponds to a specific HTTP status code and is used to communicate different types of responses to the client.

Common HTTP Response Methods:

What are Filters?

A filter is a component that allows you to run custom logic(code) before or after an action method is executed, helping you handle tasks like authentication, authorization, logging, validation and exception handling across your API. It allows injecting reusable logic into the request processing pipeline.

Types of Filters:

1. Authorization Filters: Implements IAuthorizationFilter.
2. Resource Filter: Implements IResourceFilter.
3. Action Filters: Implements IActionFilter.
4. Exception Filters: Implements IExceptionFilter.
5. Result Filters: Implements IResultFilter.

You can apply a filter globally, at the controller level, or at the action method level.

What is Authorization Filter?

An Authorization Filter is a filter that checks whether a user or client is authorized to execute a specific action or access a resource before the action method is executed, ensuring that only users with the proper credentials, roles, or permissions can proceed with the request. If the user is not authorized, the filter can block the request and return an appropriate response, such as a ‘401 Unauthorized’ or ‘403 Forbidden’ status code. The [Authorize] attribute is a built-in authorization filter.

You can create a custom authorization filter by implementing the IAuthorizationFilter interface and it has one method that you can override:

• OnAuthorization(AuthorizationFilterContext) – Called early in the filter pipeline to confirm the request is authorized.

public class CustomAuthorizationFilter : IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationFilterContext context)
    {
        var user = context.HttpContext.User;

        if (!user.Identity.IsAuthenticated)
        {
            // If the user is not authenticated, return 401 Unauthorized
            context.Result = new UnauthorizedResult();
        }
        else if (!user.IsInRole("Admin"))
        {
            // If the user is authenticated but not in the Admin role, return 403 Forbidden
            context.Result = new ForbidResult();
        }
    }
} 

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers(options =>
    {
        options.Filters.Add(new CustomAuthorizationFilter());
    });
} 

[Authorize]
[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
    // Actions go here...
} 

[HttpGet("{id}")]
[Authorize(Roles = "Admin")]
public IActionResult GetProduct(int id)
{
    // Action logic...
    return Ok(new { ProductId = id, Name = "Sample Product" });
} 

What is Resource Filter?

A Resource Filter is a filter that runs before and after the execution of the rest of the request pipeline. Resource filters are executed after authorization filters but before model binding (Action Filters, Exception Filters, and Result Filters), making them ideal for tasks like caching, enforcing model validation, or short-circuiting the request pipeline.

You can create a custom resource filter by implementing the IResourceFilter interface and for async type IAsyncResourceFilter interface. It has the following methods that you can override:

• OnResourceExecuted(ResourceExecutedContext) – Called after execution of the remainder of the pipeline.
• OnResourceExecuting(ResourceExecutingContext) – Called before execution of the remainder of the pipeline.
• OnResourceExecutionAsync(ResourceExecutingContext, ResourceExecutionDelegate) – Called asynchronously before the rest of the pipeline.

public class CacheResourceFilter : IResourceFilter
{
    private readonly IMemoryCache _cache;

    public CacheResourceFilter(IMemoryCache cache)
    {
        _cache = cache;
    }

    public void OnResourceExecuting(ResourceExecutingContext context)
    {
        // Check if the response is already cached
        if (_cache.TryGetValue(context.HttpContext.Request.Path, out var cachedResponse))
        {
            context.Result = (IActionResult)cachedResponse; // Return the cached response
        }
    }

    public void OnResourceExecuted(ResourceExecutedContext context)
    {
        // Cache the response if it wasn't already cached
        if (context.Result != null && !_cache.TryGetValue(context.HttpContext.Request.Path, out _))
        {
            _cache.Set(context.HttpContext.Request.Path, context.Result);
        }
    }
} 

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers(options =>
    {
        options.Filters.Add<CacheResourceFilter>();
    });
} 

[ServiceFilter(typeof(CacheResourceFilter))]
[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
    [HttpGet("{id}")]
    public IActionResult GetProduct(int id)
    {
        // Action logic...
        return Ok(new { ProductId = id, Name = "Sample Product" });
    }
} 

What is Action Filter?

An Action Filter is a filter that allows you to execute custom logic before and after an action method is executed. It’s useful for handling cross-cutting concerns like logging, validation, or modifying the result returned by an action.

You can create a custom action filter by deriving from the ActionFilterAttribute class and it has the following methods that you can override:

• OnActionExecuted(ActionExecutedContext) – Called after the action method executes.
• OnActionExecuting(ActionExecutingContext) – Called before the action method executes.
• OnResultExecuted(ResultExecutedContext) – Called after the action result executes.
• OnResultExecuting(ResultExecutingContext) – Called before the action result executes.

public class LogActionFilter : ActionFilterAttribute
{
	public override void OnActionExecuting(ActionExecutingContext filterContext)
	{
	   Log("OnActionExecuting", filterContext.RouteData);       
	}

	public override void OnActionExecuted(ActionExecutedContext filterContext)
	{
	   Log("OnActionExecuted", filterContext.RouteData);       
	}

	public override void OnResultExecuting(ResultExecutingContext filterContext)
	{
	   Log("OnResultExecuting", filterContext.RouteData);       
	}

	public override void OnResultExecuted(ResultExecutedContext filterContext)
	{
	   Log("OnResultExecuted", filterContext.RouteData);       
	}


	private void Log(string methodName, RouteData routeData)
	{
	   var controllerName = routeData.Values["controller"];
	   var actionName = routeData.Values["action"];
	   var message = String.Format("{0} controller:{1} action:{2}", methodName, controllerName, actionName);
	   // Debug.WriteLine(message, "Action Filter Log");
	}
} 

[ApiController]
[Route("api/[controller]")]
[LogActionFilter] // Applied at the controller level
public class ProductsController : ControllerBase
{
    [HttpGet]
    public IActionResult GetProducts()
    {
        // Action method logic
        return Ok(new List<string> { "Product1", "Product2" });
    }
} 

What is Exception Filter?

An Exception Filter is a filter that handles exceptions thrown during the execution of an action method. It allows you to catch unhandled exceptions, log them, and return a custom error response to the client with a specific HTTP status code & a custom error message. Exception filters are useful for centralizing error-handling logic across your application.

You can create a custom exception filter by implementing the IExceptionFilter interface or by deriving from the ExceptionFilterAttribute class and it has the following methods that you can override:

• OnException(ExceptionContext)
• OnExceptionAsync(ExceptionContext)

public class CustomExceptionFilter : ExceptionFilterAttribute
{
    public override void OnException(ExceptionContext context)
    {
        // Log the exception (you can use any logging framework)
        Console.WriteLine($"Exception caught: {context.Exception.Message}");

        // Customize the response
        context.Result = new ObjectResult(new
        {
            Error = "An unexpected error occurred. Please try again later.",
            Details = context.Exception.Message // Optional: Include details for debugging
        })
        {
            StatusCode = StatusCodes.Status500InternalServerError
        };

        // Indicate that the exception has been handled
        context.ExceptionHandled = true;
    }
} 

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers(options =>
    {
        options.Filters.Add(new CustomExceptionFilter());
    });
} 

[ServiceFilter(typeof(CustomExceptionFilter))]
[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
    // Actions go here...
} 

[HttpGet("{id}")]
[TypeFilter(typeof(CustomExceptionFilter))]
public IActionResult GetProduct(int id)
{
    // Action logic...
} 

read full post: How to Create Custom Exception Filter in .Net Core C#?

What is Result Filter?

A Result Filter is a filter that runs before and after the execution of an action result, which is the final step in processing a request. Result filters allow you to modify the action result or response before it is sent to the client, providing an opportunity to change or add the content, headers, status codes, or perform any other post-processing tasks.

You can create a custom result filter by implementing the IResultFilter interface or by deriving from the ResultFilterAttribute class and it has the following methods that you can override:

• OnResultExecuted(ResultExecutedContext) – Called after the action result executes.
• OnResultExecuting(ResultExecutingContext) – Called before the action result executes.
• OnResultExecutionAsync(ResultExecutingContext, ResultExecutionDelegate) – Called asynchronously before the action result.

public class CustomResultFilter : ResultFilterAttribute
{
    public override void OnResultExecuting(ResultExecutingContext context)
    {
        // Code that runs before the result is executed
        Console.WriteLine("Before result execution: " + context.Result.ToString());
    }

    public override void OnResultExecuted(ResultExecutedContext context)
    {
        // Code that runs after the result has been executed
        Console.WriteLine("After result execution");
    }
} 

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers(options =>
    {
        options.Filters.Add(new CustomResultFilter());
    });
} 

[ServiceFilter(typeof(CustomResultFilter))]
[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
    // Actions go here...
} 

[HttpGet("{id}")]
[TypeFilter(typeof(CustomResultFilter))]
public IActionResult GetProduct(int id)
{
    // Action logic...
    return Ok(new { ProductId = id, Name = "Sample Product" });
} 

In which order are filters executed in the request processing pipeline?

Filters work by providing hooks into the request processing pipeline, allowing you to execute custom logic at various stages of the request and response.

Filters are executed in a specific order: Authorization Filters → Resource Filters → Action Filters → Exception Filters → Result Filters

The order of execution ensures that authorization happens first, followed by action execution, and finally, any result processing or exception handling. The following diagram shows how filter types interact in the filter pipeline:

What are the different ways to apply or implement filters in .NET Core Web API?

Multiple ways to apply filters, they are:

• Global-Level: Filters can be registered globally in the Startup.cs file, applying them to all controllers and actions in the application.
  ▼ Show example

  
  

  In 'Startup.cs' file

  public void ConfigureServices(IServiceCollection services)
  {
      services.AddControllers(options =>
      {
          options.Filters.Add(new MyActionFilter());
      });
  }

  
  
  

  Custom Filter Class

  public class MyActionFilter : IActionFilter
  {
      public void OnActionExecuting(ActionExecutingContext context)
      {
          // Code before action executes
      }
  
      public void OnActionExecuted(ActionExecutedContext context)
      {
          // Code after action executes
      }
  } 

• Controller-Level: Filters can be applied to specific controllers by using [TypeFilter] or [ServiceFilter] attributes on the controller class.
  ▼ Show example

  [ApiController]
  [Route("api/[controller]")]
  [ServiceFilter(typeof(MyActionFilter))]
  public class ProductsController : ControllerBase
  {
      [HttpGet]
      public IActionResult GetProducts()
      {
          // ....
      }
  } 

• Action-Level: Filters can be applied to individual action methods by using [TypeFilter] or [ServiceFilter] attributes on the action method.
  ▼ Show example

  [ApiController]
  [Route("api/[controller]")]
  public class ProductsController : ControllerBase
  {
      [HttpGet]
      [TypeFilter(typeof(MyActionFilter))]
      public IActionResult GetProduct(int id)
      {
          // ....
      }
  } 

• Middleware-Based Filters: Custom logic similar to filters can be implemented using middleware, which operates at the application level.
  ▼ Show example

  
  

  In 'Startup.cs' file

  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  {
      app.UseMiddleware<CustomMiddleware>();
  
      app.UseRouting();
      // ....
  } 

  
  
  

  Custom Middleware Class

  public class CustomMiddleware
  {
      private readonly RequestDelegate _next;
  
      public CustomMiddleware(RequestDelegate next)
      {
          _next = next;
      }
  
      public async Task InvokeAsync(HttpContext context)
      {
          // Pre-processing logic
          context.Response.Headers.Add("X-Custom-Middleware", "This is custom middleware");
  
          await _next(context);
  
          // Post-processing logic
      }
  }

How do you configure Filters globally?

You can add global filters in the ConfigureServices method, in Startup.cs file.

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers(options =>
        {
            // Add global filters here
            options.Filters.Add(new CustomActionFilter());
            options.Filters.Add(new AuthorizeFilter());
        });
    }
} 

How do you implement content filtering in Web API?

There are different approaches to implementing content filtering in a Web API:

1. Creating custom 'Action Filter': You can create a custom action filter by implementing IActionFilter interface or deriving from ActionFilterAttribute class to inspect & modify the content of request data before the action method is executed and then you can apply the custom filter globally, to specific controllers, or to individual actions.
   ▼ Show example

   
   

   Content Filtering by using 'ActionFilterAttribute'
   
   1. Create a Custom Action Filter:

   public class ContentFilterAttribute : ActionFilterAttribute
   {
       public override void OnActionExecuting(ActionExecutingContext context)
       {
           // Example: Filtering out offensive words
           var request = context.HttpContext.Request;
           if (request.Method == HttpMethod.Post.ToString() || request.Method == HttpMethod.Put.ToString())
           {
               // Assuming the request content is JSON
               var content = new StreamReader(request.Body).ReadToEnd();
   
               // Simple content filtering logic
               if (content.Contains("offensiveWord"))
               {
                   context.Result = new BadRequestObjectResult("Inappropriate content detected.");
                   return;
               }
   
               // Reset the request body stream after reading
               var memoryStream = new MemoryStream();
               var writer = new StreamWriter(memoryStream);
               writer.Write(content);
               writer.Flush();
               memoryStream.Position = 0;
               request.Body = memoryStream;
           }
   
           base.OnActionExecuting(context);
       }
   } 

   
   
   

   2. Apply the Content Filter to Actions or Controllers:
   a) To apply globally.

   public class Startup
   {
       public void ConfigureServices(IServiceCollection services)
       {
           services.AddControllers(options =>
           {
               options.Filters.Add(new ContentFilterAttribute()); // Apply globally
           });
       }
   } 

   
   b) To apply to a Controller or Action.

   [ApiController]
   [Route("api/[controller]")]
   public class MessagesController : ControllerBase
   {
       [HttpPost]
       [ContentFilter] // Apply to a specific action
       public IActionResult PostMessage([FromBody] string message)
       {
           // The action logic
           return Ok("Message received");
       }
   } 

2. Creating Custom Middleware: Alternatively, you can implement content filtering as middleware to have more control over the entire request and response process.
   ▼ Show example

   public class ContentFilteringMiddleware
   {
       private readonly RequestDelegate _next;
   
       public ContentFilteringMiddleware(RequestDelegate next)
       {
           _next = next;
       }
   
       public async Task InvokeAsync(HttpContext context)
       {
           // Example: Check for inappropriate content in request body
           context.Request.EnableBuffering();
           var bodyAsText = await new StreamReader(context.Request.Body).ReadToEndAsync();
   
           if (bodyAsText.Contains("offensiveWord"))
           {
               context.Response.StatusCode = StatusCodes.Status400BadRequest;
               await context.Response.WriteAsync("Inappropriate content detected.");
               return;
           }
   
           // Reset the request body stream position
           context.Request.Body.Position = 0;
   
           // Call the next middleware in the pipeline
           await _next(context);
       }
   }
   
   
   // Register the middleware in the pipeline
   public class Startup
   {
       public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
       {
           app.UseMiddleware<ContentFilteringMiddleware>();
   
           app.UseRouting();
           app.UseEndpoints(endpoints =>
           {
               endpoints.MapControllers();
           });
       }
   } 

What are the differences between the [ServiceFilter] and [TypeFilter] attributes?

Service Filter: Filters can be applied to a controller or action method using Dependency Injection by using the [ServiceFilter] attribute, allowing the filter to access services from the DI container. Since the filter is resolved through the DI container, you can inject services into the filter’s constructor. This is useful when the filter needs to use services like logging, data access, or any other service registered in the DI container. The [ServiceFilter] attribute takes the type of the filter as a parameter. The filter is then resolved from the DI container and applied to the controller or action method where the attribute is used.

Type Filter: Filters can be applied to a controller or action method using the [TypeFilter] attribute, which allows passing parameters to the filter’s constructor using the ‘Arguments’ property. Unlike [ServiceFilter], which directly uses the DI container to resolve the filter, [TypeFilter] creates a new instance of the filter using the specified type. If the filter’s constructor has dependencies that are registered in the DI container, [TypeFilter] will resolve and inject those dependencies automatically. [TypeFilter] is particularly useful when you need to apply a filter with parameters that are not known until runtime.

Comparison of the [ServiceFilter] and [TypeFilter] attributes in a tabular format.

[ServiceFilter(typeof(MyFilter))] 

[TypeFilter(typeof(MyFilter), Arguments = new object[] { "param" })] 

What is URL rewriting and how do you implement it?

URL rewriting is a process where the URL requested by a client is transformed into another URL before it reaches the server’s request handler. This is often used for purposes such as improving SEO, providing clean and user-friendly URLs, or redirecting old URLs to new ones without changing the underlying resource. You need to add the URL rewriting middleware UseRewriter() in the request pipeline and define rules using RewriteOptions, in ‘Startup.cs’ file.

public class Startup
{
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        // Define the rewrite options
        var rewriteOptions = new RewriteOptions()
            .AddRedirect("old-url/(.*)", "new-url/$1")   // Redirect old URLs to new ones
            .AddRewrite(@"^products/(\d+)", "api/products/$1", skipRemainingRules: true); // Rewrite /products/{id} to /api/products/{id}

        // Use the URL Rewriting middleware
        app.UseRewriter(rewriteOptions);
    }
} 

What is [NonAction] attribute and how do you use it?

The [NonAction] attribute is used to indicate that a particular method in a controller is not an action method. If you don’t want it to be exposed as an API endpoint and cannot be called by HTTP requests, you can decorate it with the [NonAction] attribute

[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
	[HttpGet("{id}")]
	public IActionResult GetProduct(int id)
	{
		// ....
	}

	[NonAction]
	public string FormatProductName(string name)
	{
		// This is a utility method and should not be exposed as an API endpoint
	}
} 

What is the difference between IActionResult and ActionResult?

IActionResult and ActionResult are both used to define the return type of a controller action method, but they serve slightly different purposes and provide different levels of type safety and flexibility.

1) IActionResult is an interface that represents a result of an action method. It provides a contract for different types of HTTP responses, such as OkResult, BadRequestResult, NotFoundResult, etc. It is generally used when an action method can return different types of HTTP responses based on various conditions. Since it is not tied to a specific type, it offers flexibility but less type safety.

public IActionResult GetProduct(int id)
{
    var product = _productService.GetById(id);
    if (product == null)
    {
        return NotFound(); // 404 Not Found
    }
    return Ok(product); // 200 OK with the product data
} 

2) ActionResult<T> is a generic class that inherits from ActionResult and wraps a response of type T. It combines the benefits of IActionResult with type safety by allowing the action to return either a specific type T or an IActionResult. It is used when you want to return either a specific object (like a model) or an HTTP response. This allows for strong typing, which is particularly useful for scenarios involving serialization of data.

public ActionResult<Product> GetProduct(int id)
{
    var product = _productService.GetById(id);
    if (product == null)
    {
        return NotFound(); // 404 Not Found
    }
    return product; // 200 OK with the product data
} 

What are the different Service Lifetimes for Dependency Injection within ASP.NET Core?

There are 3 different types of service lifetimes defined by the .NET Core DI framework.

1. Transient: A new instance is created every time the service is requested. This lifetime works best for lightweight, stateless services.
   syntax: AddTransient<IService, Implementation>()
2. Scoped: A new instance is created once per request.
   syntax: AddScoped<IService, TImplementation>()
3. Singleton: A single instance is created and shared throughout the application’s lifetime.
   syntax: AddSingleton<IService, TImplementation>()

How do you manage Dependency Injection in a Web API project?

Dependency Injection (DI) is a design pattern that helps in creating loosely coupled, testable, and maintainable applications by managing the dependencies of objects. In an ASP.NET Core Web API project, DI is a built-in feature that allows you to inject dependencies into your classes rather than hard-coding them. Dependency Injection in a Web API project involves:

• Registering services in the Program.cs or Startup.cs file using AddTransient, AddScoped, or AddSingleton.
• Injecting dependencies into controllers, services, and middleware using constructor injection.

// 1. Create Interface
public interface IMyService
{
    void GetAllProducts();
} 

// 2. Implement Interface
public class MyService : IMyService
{
    public void GetAllProducts()
    {
        // Perform some operations
    }
}

// 3. Register Service
public class Program
{
    public static void Main(string[] args)
    {
        var builder = WebApplication.CreateBuilder(args);

        // ...

        // Register application services
        builder.Services.AddTransient<IMyService, MyService>();  // Transient lifetime
        builder.Services.AddScoped<IRepository, Repository>();  // Scoped lifetime
        builder.Services.AddSingleton<ILogger, Logger>();       // Singleton lifetime

        // ....
        app.Run();
    }
}


// 4. Use Service
public class ProductsController : ControllerBase
{
    private readonly IMyService _myService;

    // Constructor injection
    public ProductsController(IMyService myService)
    {
        _myService = myService;
    }

    [HttpGet]
    public IActionResult GetProducts()
    {
        var products = _myService.GetAllProducts();
        return Ok(products);
    }
}

What is ModelState?

ModelState represents the state of model binding and validation for a request. Specifically, it is a dictionary that stores information about the validation errors that occurred during model binding.

The framework performs validation on the incoming data (e.g., checking required fields, data types, etc.).If any validation fails, the errors are stored in ‘ModelState’.

You can check if the ‘ModelState’ is valid using ModelState.IsValid property. This ensures that only valid data is processed.

If ‘ModelState’ is invalid(false), you can return a response with the validation errors, usually a ‘400 Bad Request’, along with the error details.

[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
    [HttpPost]
    public IActionResult CreateProduct([FromBody] Product model)
    {
        // Check if the model state is valid
        if (!ModelState.IsValid)
        {
            // Return a 400 Bad Request response with the validation errors
            return BadRequest(ModelState);
        }

        // Proceed with processing the valid model
        // Logic to create the product...
        return Ok("Product created successfully");
    }
} 

How do you check or automate Model Validation?

(or) What are the different methods to apply ModelState in an application?

ModelState can be checked manually in each action method or with an automatic approach which is generally applied globally. You can apply any approach according to your application needs to validate models in an application:

Different methods to apply ModelState:

1. Manual Action-Level Model Validation: You can check ModelState manually in each action method to ensure the model is valid before proceeding with the business logic.
2. Automatic Model Validation: You can automatically validate ModelState and return errors globally, without the need to manually check ModelState in each action. You can implement it in two ways:
   • Using [ApiController] Attribute: The [ApiController] attribute automatically checks ModelState at the start of each request, before the controller action is invoked. If the model is invalid, it returns a ‘400 Bad Request‘ response with the validation errors. It automatically applies ModelStateInvalidFilter.
   • Using Custom Filter: You can create a custom action filter using IActionFilter or ActionFilterAttribute to check the ModelState. It can be applied globally, to the specific controllers, or at each action level.

In any case, you need to create a Model property with validation rules using data annotations and for validation use ModelState.IsValid property to check if the model is valid.

public class Product
{
    [Required(ErrorMessage = "Product name is required.")]
    [StringLength(100, ErrorMessage = "Product name cannot be longer than 100 characters.")]
    public string Name { get; set; }

    [Range(1, 1000, ErrorMessage = "Price must be between 1 and 1000.")]
    public decimal Price { get; set; }
} 

public class ProductsController : ApiController
{
    [HttpPost]
    public IHttpActionResult CreateProduct(Product product)
    {
        if (!ModelState.IsValid)
        {
            return BadRequest(ModelState); // Returns a 400 Bad Request with validation errors
        }

        // Logic to save the product
        return Ok(product); // Returns a 200 OK response
    }
} 

[ApiController]
[Route("api/[controller]")]
public class EventsController : ControllerBase
{
    [HttpPost]
    public IActionResult CreateEvent([FromBody] Event newEvent)
    {
        // No need to check ModelState manually; it's handled automatically.
        return Ok("Event created successfully.");
    }
} 

public class ValidateModelAttribute : ActionFilterAttribute
{
	public override void OnActionExecuting(HttpActionContext actionContext)
	{
		if (!actionContext.ModelState.IsValid)
		{
			actionContext.Response = actionContext.Request.CreateErrorResponse(
				HttpStatusCode.BadRequest, actionContext.ModelState);
		}
	}
}

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers(options =>
        {
            // Add global filters here
            options.Filters.Add(new ValidateModelAttribute());
        });
    }
} 

[ValidateModel] // Apply at controller level
[Route("api/[controller]")]
public class EventsController : ControllerBase
{
    [HttpPost]
    public IActionResult CreateEvent([FromBody] Event newEvent)
    {
        // ModelState is automatically validated
        return Ok("Event created successfully.");
    }
} 

[Route("api/[controller]")]
public class EventsController : ControllerBase
{
    [HttpPost]
    [ValidateModel] // Apply at action level
    public IActionResult CreateEvent([FromBody] Event newEvent)
    {
        // ModelState is automatically validated
        return Ok("Event created successfully.");
    }
} 

How to disable automatic Model State Validation?

Automatic ModelState validation can be disabled both at the global and action levels:

• Using [SuppressModelStateInvalidFilter] property: The [SuppressModelStateInvalidFilter] is used to override the default behavior of automatic ModelState validation that comes with the [ApiController] attribute. You can use [SuppressModelStateInvalidFilter] globally or in scenarios where you want to handle ModelState validation manually for specific actions or controllers while still keeping the [ApiController] attribute on the controller.
  ▼ Show example

  
  

  At Global Level: In the Startup.cs file, modify the ConfigureServices method.

  public class Startup
  {
  	public void ConfigureServices(IServiceCollection services)
  	{
  		services.Configure<ApiBehaviorOptions>(options =>
  		{
  			// Disable the automatic model state validation
  			options.SuppressModelStateInvalidFilter = true;
  		});
  	}
  } 

• Removing the [ApiController] attribute: If you want to disable automatic ModelState validation for a specific action or controller while keeping it enabled globally, you can do so by removing the [ApiController] attribute from the controller and handling ModelState manually.
  ▼ Show example

  // Simply remove the [ApiController] attribute from the controller
  [Route("api/[controller]")]
  public class EventsController : ControllerBase
  {
      [HttpPost]
      public IActionResult CreateEvent([FromBody] Event newEvent)
      {
          // Manual ModelState check
          if (!ModelState.IsValid)
          {
              return BadRequest(ModelState);
          }
  
          return Ok("Event created successfully.");
      }
  } 

How to create Custom Data Annotation Validators?

You can create a custom validation attribute by inheriting from ValidationAttribute and override the IsValid method to implement custom validation logic. Apply the custom attribute to the model properties that need validation. Validate the model in your API controller and handle invalid models appropriately.

using System;
using System.ComponentModel.DataAnnotations;
using System.Text.RegularExpressions;

public class Alphanumeric : ValidationAttribute
{
    public override bool IsValid(Object value)
    {
        if (Regex.IsMatch(value.ToString(), "^[a-zA-Z0-9]*$"))
        {
            return true;
        }
        return false;
    }
} 

[Alphanumeric(ErrorMessage = "Code only accecpts alpha numeric value.")]
public string Code { get; set; } 

[ApiController]
[Route("api/[controller]")]
public class EventsController : ControllerBase
{
    [HttpPost]
    public IActionResult CreateEvent([FromBody] Event newEvent)
    {
        if (!ModelState.IsValid)
        {
            return BadRequest(ModelState);
        }

        // Logic to save the event
        return Ok("Event created successfully.");
    }
} 

public class ValidationFilterAttribute : IActionFilter
{
    public void OnActionExecuted(ActionExecutedContext context)
    {
        return;
    }

    public void OnActionExecuting(ActionExecutingContext context)
    {
        // custom json error response result.	
        ResultObject resultDto = new ResultObject();

        if (!context.ModelState.IsValid)
        {
            resultDto.ErrorMessage = string.Join(Environment.NewLine, context.ModelState.Values.SelectMany(x => x.Errors).Select(x => x.ErrorMessage));
            resultDto.HasError = true;
            resultDto.ResponseCode = 400;
            context.Result = new JsonResult(resultDto);

            context.HttpContext.Response.StatusCode = 400;
        }
    }
} 

What is a message handler, and how do you use it in Web API?

Message handlers in Web API are components that process HTTP requests and responses. They act as a pipeline, allowing you to intercept, process, or modify HTTP messages before they reach the controller or after they leave it. Message handlers are particularly useful for tasks like logging, authentication, or custom request processing. You create a custom handler by inheriting from DelegatingHandler and registering it in the Web API configuration.

public class CustomMessageHandler : DelegatingHandler
{
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        // Pre-processing logic (e.g., logging)
        var requestInfo = $"Method: {request.Method}, URI: {request.RequestUri}";
        Console.WriteLine($"Request: {requestInfo}");

        // Call the inner handler to continue processing
        var response = await base.SendAsync(request, cancellationToken);

        // Post-processing logic (e.g., modifying response)
        response.Headers.Add("X-Custom-Header", "CustomHeaderValue");

        return response;
    }
} 

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        // Register the custom message handler
        config.MessageHandlers.Add(new CustomMessageHandler());
    }
} 

What are different strategies to protect Web API in .NET?

Securing a Web API in .NET involves a combination of authentication, authorization, HTTPS enforcement, CORS configuration, data validation, rate limiting, logging, and monitoring. Together, these strategies ensure that your API is protected against unauthorized access and potential threats.

1. Authentication: Verify the identity of the user or system accessing the API like,
   • JWT (JSON Web Tokens): Use tokens to authenticate requests. Clients include the token in the Authorization header.
   • OAuth2/OpenID Connect: Implement industry-standard protocols for token-based authentication.
   • API Keys: Simple method where clients include a key in their requests.
2. Authorization: Control what authenticated users can access or do.
   • Role-Based Authorization: Define user roles and restrict access to certain endpoints based on these roles.
   • Policy-Based Authorization: Create custom authorization policies based on complex conditions.
3. HTTPS (SSL/TLS): Configure the server to enforce HTTPS, ensuring that all communication between the client and server is encrypted.
4. CORS (Cross-Origin Resource Sharing): Restrict which domains can access your API from a browser. Define allowed origins, methods, and headers in your API configuration.
5. Data Validation and Sanitization: Validate and sanitize incoming data to protect against injection attacks. Use model validation attributes and sanitize inputs where necessary.
6. Rate Limiting and Throttling: Limit the number of requests a client can make in a given time frame to protect against abuse. Use middleware or external services to enforce rate limits.
7. Logging and Monitoring: Track API usage and detect suspicious activities. Integrate logging frameworks like Serilog and monitoring tools like Application Insights.
8. Anti-Forgery Tokens: Protect against Cross-Site Request Forgery (CSRF) attacks. Use anti-forgery tokens in state-changing requests (e.g., POST, PUT).

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = "yourIssuer",
                ValidAudience = "yourAudience",
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("yourSecretKey"))
            };
        }); 

[Authorize(Roles = "Admin")]
public IActionResult GetSensitiveData()
{
    return Ok("Sensitive data only for Admins.");
} 

app.UseHttpsRedirection(); 

services.AddCors(options =>
{
    options.AddPolicy("AllowSpecificOrigin",
        builder => builder.WithOrigins("https://example.com")
                          .AllowAnyMethod()
                          .AllowAnyHeader());
});

app.UseCors("AllowSpecificOrigin"); 

public class Product
{
    [Required]
    [StringLength(100)]
    public string Name { get; set; }

    [Range(0, 1000)]
    public decimal Price { get; set; }
} 

services.AddRateLimiting(options =>
{
    options.GlobalRateLimit = new RateLimitRule
    {
        Period = "1m",
        Limit = 100
    };
}); 

services.AddApplicationInsightsTelemetry(); 

services.AddAntiforgery(options => 
{
    options.HeaderName = "X-XSRF-TOKEN";
}); 

How do you implement Custom Authorization filters in Web API?

Custom authorization filters allow you to enforce specific security requirements before an action method is executed. These filters can be used to implement custom logic to determine whether a user or request should be allowed to proceed.

Steps to Implement Custom Authorization Filters:

1. Create a Custom Authorization Filter: Implement the IAuthorizationFilter interface or derive from AuthorizeAttribute to create a custom authorization filter.
   ▼ Show example

   public class CustomAuthorizeAttribute : AuthorizeAttribute, IAuthorizationFilter
   {
       public void OnAuthorization(AuthorizationFilterContext context)
       {
           // Custom logic to check if the user is authorized
           var isAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;
   
           if (!isAuthenticated)
           {
               // If the user is not authorized, set the result to 401 Unauthorized
               context.Result = new UnauthorizedResult();
           }
           // Add more custom checks here if needed
       }
   } 

2. Apply the Custom Authorization Filter: Apply the filter to controllers or actions by using the [CustomAuthorize] attribute.
   ▼ Show example

   
   

   Method 1: In Action level.

   [ApiController]
   [Route("api/[controller]")]
   public class SecureController : ControllerBase
   {
       [HttpGet]
       [CustomAuthorize] // Apply the custom authorization filter
       public IActionResult GetSecureData()
       {
           return Ok("This is secured data");
       }
   } 

   
   
   

   Method 2: Optionally, if you want the custom authorization to apply globally to all controllers, register it in the Startup.cs or Program.cs.

   public class Startup
   {
       public void ConfigureServices(IServiceCollection services)
       {
           services.AddControllers(options =>
           {
               options.Filters.Add(new CustomAuthorizeAttribute()); // Register globally
           });
       }
   } 

How do you handle Authorization in a Web API using Policies?

How do you implement a Custom authorization Handler? (See ‘Method 2’ in the example).

Authorization in a Web API using policies allows you to implement fine-grained access control by defining rules (policies) that determine whether a user is authorized to access specific resources or perform specific actions. Policies are defined in the ‘Program.cs’ or ‘Startup.cs’ file, and they can be based on roles, claims, or custom logic. You apply these policies using the [Authorize] attribute on controllers or actions, and you can also create custom authorization requirements for more complex scenarios.

public class Program
{
    public static void Main(string[] args)
    {
        var builder = WebApplication.CreateBuilder(args);

        // Add services to the container.
        builder.Services.AddControllers();

        // Add authorization policies
        builder.Services.AddAuthorization(options =>
        {
            options.AddPolicy("AdminOnly", policy =>
                policy.RequireRole("Admin"));

            options.AddPolicy("Over18Only", policy =>
                policy.RequireClaim("Age", "18"));

            options.AddPolicy("CustomPolicy", policy =>
                policy.RequireAssertion(context =>
                    context.User.HasClaim(c => c.Type == "Permission" && c.Value == "CanAccessResource")));
        });

        var app = builder.Build();

        // Configure the HTTP request pipeline.
        app.UseAuthorization();

        app.MapControllers();

        app.Run();
    }
} 

[Authorize(Policy = "AdminOnly")]
[ApiController]
[Route("api/[controller]")]
public class AdminController : ControllerBase
{
    [HttpGet]
    public IActionResult GetAdminData()
    {
        return Ok("This is admin data.");
    }
}

[Authorize(Policy = "Over18Only")]
[HttpGet]
[Route("api/age-restricted")]
public IActionResult GetAgeRestrictedData()
{
    return Ok("This content is restricted to users over 18.");
}

[Authorize(Policy = "CustomPolicy")]
[HttpGet]
[Route("api/custom-resource")]
public IActionResult GetCustomResource()
{
    return Ok("This is a resource protected by a custom policy.");
} 

public class MinimumAgeRequirement : IAuthorizationRequirement
{
    public int MinimumAge { get; }

    public MinimumAgeRequirement(int minimumAge)
    {
        MinimumAge = minimumAge;
    }
}

public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                   MinimumAgeRequirement requirement)
    {
        var userBirthDate = context.User.FindFirst(c => c.Type == ClaimTypes.DateOfBirth);
        if (userBirthDate != null)
        {
            var birthDate = Convert.ToDateTime(userBirthDate.Value);
            int calculatedAge = DateTime.Today.Year - birthDate.Year;
            if (calculatedAge >= requirement.MinimumAge)
            {
                context.Succeed(requirement);
            }
        }
        return Task.CompletedTask;
    }
}

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AtLeast21", policy =>
        policy.Requirements.Add(new MinimumAgeRequirement(21)));
});

builder.Services.AddSingleton<IAuthorizationHandler, MinimumAgeHandler>(); 

What is OAuth?

OAuth (Open Authorization) is an open standard for token-based authentication and authorization, allowing third-party applications to access user data from another service (like Google, Facebook, or Twitter) without exposing the user’s credentials (e.g., username and password). OAuth is commonly used to grant secure access to APIs on behalf of a user, using access tokens rather than sharing login credentials.

OAuth is commonly used for single sign-on (SSO) and for authorizing applications to interact with APIs on behalf of a user.

The OAuth flow typically involves:

• The client requests authorization from the resource owner.
• The resource owner grants access and the authorization server issues an access token to the client.
• The client uses this token to access the resource server.

What is JWT?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are widely used for authentication and authorization in web applications and APIs. They are compact, URL-safe, and can be easily transmitted between a client and a server.

A JWT consists of three parts:

1. Header: Contains metadata about the token, including the type of token (JWT) and the signing algorithm used (e.g., HMAC SHA256).
2. Payload: Contains the claims, which are statements about an entity (typically, the user) and additional data. Common claims include sub (subject, usually the user ID), exp (expiration time), and iat (issued at time).
3. Signature: Ensures that the token hasn’t been altered. It’s created by signing the header and payload using a secret key and the specified algorithm.

How do you secure a Web API using JWT?

To secure a Web API using JWT, you need to follow these steps:

1. Generate a JWT on User Authentication: When a user successfully authenticates (e.g., by providing a username and password), the server generates a JWT containing the user’s claims. The server then sends this token back to the client.
   ▼ Show example

   public string GenerateJwtToken(string username)
   {
       var claims = new[]
       {
           new Claim(JwtRegisteredClaimNames.Sub, username),
           new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
       };
   
       var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key"));
       var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
   
       var token = new JwtSecurityToken(
           issuer: "yourIssuer",
           audience: "yourAudience",
           claims: claims,
           expires: DateTime.Now.AddMinutes(30),
           signingCredentials: creds);
   
       return new JwtSecurityTokenHandler().WriteToken(token);
   } 

2. Client Stores and Sends JWT: The client (e.g., a web or mobile app) stores the JWT, typically in local storage or a cookie. For each subsequent API request, the client includes the JWT in the Authorization header as a Bearer token.
   ▼ Show example

   GET /api/products
   Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... 

3. Configure JWT Authentication in the Web API: In your ASP.NET Core Web API, configure the JWT authentication middleware to validate incoming tokens.
   ▼ Show example

   services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
           .AddJwtBearer(options =>
           {
               options.TokenValidationParameters = new TokenValidationParameters
               {
                   ValidateIssuer = true,
                   ValidateAudience = true,
                   ValidateLifetime = true,
                   ValidateIssuerSigningKey = true,
                   ValidIssuer = "yourIssuer",
                   ValidAudience = "yourAudience",
                   IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key"))
               };
           }); 

4. Protect API Endpoints: Use the [Authorize] attribute to secure your API endpoints, ensuring that only authenticated users with a valid JWT can access them.
   ▼ Show example

   [Authorize]
   [HttpGet]
   public IActionResult GetSecureData()
   {
       return Ok("This is protected data.");
   } 

5. Handle Token Expiration and Refresh: JWTs typically have an expiration time (e.g., 30 minutes). When the token expires, the client should either re-authenticate or use a refresh token to obtain a new JWT.

How do you enforce SSL/TLS in a Web API?

You can use following steps to enforce SSL/TLS to ensures that all data transmitted between the client and server is encrypted, providing a secure communication channel.

1. Using 'UseHttpsRedirection' & Enabling 'HSTS': Use the UseHttpsRedirection middleware to automatically redirect HTTP requests to HTTPS and enable HSTS(HTTP Strict Transport Security) using the UseHsts middleware to ensure all communication is done over HTTPS, in Startup.cs file.
   ▼ Show example

   public class Startup
   {
       public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
       {
           if (!env.IsDevelopment())
           {
               // Redirect HTTP requests to HTTPS
               app.UseHttpsRedirection(); 
   			
               // Add HTTP Strict Transport Security (HSTS) headers
               app.UseHsts(); 
           }
   		
   		// ....
       }
   } 

2. Configure HTTPS in 'launchSettings.json' Ensure that HTTPS is enabled in the launchSettings.json file, which is used during development to configure how the application is launched.
   ▼ Show example

   {
     "profiles": {
       "IIS Express": {
         "commandName": "IISExpress",
         "launchBrowser": true,
         "environmentVariables": {
           "ASPNETCORE_ENVIRONMENT": "Development"
         },
         "sslPort": 44356
       },
       "WebAPI": {
         "commandName": "Project",
         "launchBrowser": true,
         "applicationUrl": "https://localhost:5001;http://localhost:5000",
         "environmentVariables": {
           "ASPNETCORE_ENVIRONMENT": "Development"
         }
       }
     }
   } 

   The sslPort defines the port on which HTTPS is served.
   The applicationUrl contains both HTTP and HTTPS URLs.
3. Require HTTPS Globally: Optionally, use [RequireHttps] attribute to enforce HTTPS on specific controllers or actions.
   ▼ Show example

   [ApiController]
   [Route("api/[controller]")]
   [RequireHttps] // Enforce HTTPS on all actions within this controller
   public class SecureController : ControllerBase
   {
       [HttpGet]
       public IActionResult GetSecureData()
       {
           return Ok("This data is served over HTTPS");
       }
   } 

How do you implement HTTP caching in Web API?

Implementing HTTP caching in a Web API can significantly improve performance by reducing the load on the server and decreasing the response time for clients. HTTP caching allows responses to be stored temporarily (cached) by clients or intermediate proxies, so subsequent requests can be served from the cache instead of recomputing the response.

HTTP caching in Web API can be implemented using several techniques:

1. Cache-Control Header: The Cache-Control header is used to specify directives for caching mechanisms in both requests and responses.
▼ Show example

public class ProductsController : ApiController
{
    [HttpGet]
    [Route("api/products")]
    public IHttpActionResult GetProducts()
    {
        var products = GetProductsFromDatabase();

        // Set Cache-Control header for 60 seconds
        HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.Public);
        HttpContext.Current.Response.Cache.SetMaxAge(TimeSpan.FromSeconds(60));

        return Ok(products);
    }
} 

2. Expires header: The Expires header specifies a date and time after which the response is considered stale.
▼ Show example

public class ProductsController : ApiController
{
    [HttpGet]
    [Route("api/products")]
    public IHttpActionResult GetProducts()
    {
        var products = GetProductsFromDatabase();

        // Set the Expires header
        HttpContext.Current.Response.Cache.SetExpires(DateTime.UtcNow.AddMinutes(5));
        HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.Public);

        return Ok(products);
    }
} 

3. OutputCache Attribute: The [OutputCache] attribute can be used to cache the output of an action method. However, it’s important to note that this is specific to ASP.NET Web API 2 and earlier versions.
▼ Show example
public class ProductsController : ApiController
{
    [HttpGet]
    [Route("api/products")]
    [OutputCache(Duration = 60, VaryByParam = "none")]
    public IHttpActionResult GetProducts()
    {
        var products = GetProductsFromDatabase();
        return Ok(products);
    }
} 
• Duration: Specifies how long the response should be cached, in seconds.
• VaryByParam: Specifies whether to vary the cached response based on query string parameters.
4. ETag header: It enables conditional caching to avoid sending unchanged data. If the resource hasn’t changed since the last request, the server can return a 304 Not Modified status instead of sending the full response.
▼ Show example

public class ProductsController : ApiController
{
    [HttpGet]
    [Route("api/products/{id}")]
    public IHttpActionResult GetProduct(int id)
    {
        var product = GetProductById(id);
        if (product == null)
        {
            return NotFound();
        }

        var etag = ComputeETag(product);
        if (HttpContext.Current.Request.Headers["If-None-Match"] == etag)
        {
            return StatusCode(HttpStatusCode.NotModified);
        }

        HttpContext.Current.Response.Headers["ETag"] = etag;
        return Ok(product);
    }

    private string ComputeETag(Product product)
    {
        // Simplified example: generate an ETag based on product properties
        return $"\"{product.Id}-{product.LastModified.Ticks}\"";
    }
} 

5. Response Caching Middleware: You can use the response caching middleware to enable caching.
▼ Show example

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers();
        services.AddResponseCaching();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseResponseCaching();

        app.UseRouting();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}

// Controller Example
[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
    [HttpGet]
    [ResponseCache(Duration = 60)]
    public IActionResult GetProducts()
    {
        var products = GetProductsFromDatabase();
        return Ok(products);
    }
} 

How do you create a Custom Formatter in Web API?

Creating a Custom Formatter allows you to control how data is serialized and deserialized, enabling support for custom media types beyond the default JSON or XML.

Steps to Create a Custom Formatter:

1. Create a Custom MediaTypeFormatter: Derive a class from MediaTypeFormatter or one of its built-in subclasses (BufferedMediaTypeFormatter, JsonMediaTypeFormatter, etc.) and implement the necessary methods for reading and writing content.
   ▼ Show example

   public class CustomTextMediaTypeFormatter : MediaTypeFormatter
   {
       public CustomTextMediaTypeFormatter()
       {
           // Add the supported media type
           SupportedMediaTypes.Add(new MediaTypeHeaderValue("text/custom"));
       }
   
       // Override CanReadType to specify which types the formatter can deserialize
       public override bool CanReadType(Type type)
       {
           return type == typeof(string);
       }
   
       // Override CanWriteType to specify which types the formatter can serialize
       public override bool CanWriteType(Type type)
       {
           return type == typeof(string);
       }
   
       // Implement reading from the request body
       public override async Task<object> ReadFromStreamAsync(Type type, Stream readStream, HttpContent content, IFormatterLogger formatterLogger)
       {
           using (var reader = new StreamReader(readStream))
           {
               string result = await reader.ReadToEndAsync();
               return result;
           }
       }
   
       // Implement writing to the response body
       public override async Task WriteToStreamAsync(Type type, object value, Stream writeStream, HttpContent content, TransportContext transportContext)
       {
           using (var writer = new StreamWriter(writeStream))
           {
               await writer.WriteAsync(value.ToString());
           }
       }
   } 

2. Register the Custom Formatter in the Startup.cs or Program.cs file.
   ▼ Show example

   public class Startup
   {
       public void ConfigureServices(IServiceCollection services)
       {
           services.AddControllers(options =>
           {
               // Register the custom formatter
               options.OutputFormatters.Add(new CustomTextMediaTypeFormatter());
               options.InputFormatters.Add(new CustomTextMediaTypeFormatter());
           });
       }
   
       public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
       {
           // ....
       }
   } 

3. Use the formatter in your controllers by specifying the media type it supports (text/custom in this case).
   ▼ Show example

   [ApiController]
   [Route("api/[controller]")]
   public class CustomFormatterController : ControllerBase
   {
       [HttpGet]
       [Produces("text/custom")]
       public IActionResult Get()
       {
           return Ok("This is a custom formatted string");
       }
   
       [HttpPost]
       [Consumes("text/custom")]
       public IActionResult Post([FromBody] string value)
       {
           return Ok($"Received: {value}");
       }
   } 

What is Session State?

Session state is a server-side storage mechanism that retains user-specific data across multiple requests within a web application.

How do you handle Session State in Web API?

You can maintain Session State in a Web API by using techniques such as server-side storage, client-side tokens, or distributed caching. Below are some common approaches to handling session state:

1) Using In-Memory Caching: Suitable for simple scenarios with a single server.

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        // Add memory cache services
        services.AddMemoryCache();
        services.AddSession(options =>
        {
            options.IdleTimeout = TimeSpan.FromMinutes(30);
            options.Cookie.HttpOnly = true;
            options.Cookie.IsEssential = true;
        });

        services.AddControllers();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseHttpsRedirection();

        app.UseRouting();

        app.UseSession(); // Enable session handling

        // ....
    }
} 

[ApiController]
[Route("api/[controller]")]
public class SessionController : ControllerBase
{
    [HttpGet("set")]
    public IActionResult SetSession(string key, string value)
    {
        HttpContext.Session.SetString(key, value);
        return Ok("Session value set");
    }

    [HttpGet("get")]
    public IActionResult GetSession(string key)
    {
        var value = HttpContext.Session.GetString(key);
        return Ok(value ?? "Session value not found");
    }
} 

2) Distributed Session State: (Using Distributed Cache): Distributed cache is ideal for handling session state in environments where the API is hosted on multiple servers (e.g., in a cloud environment).

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        // Use Redis or SQL Server for distributed caching
        services.AddStackExchangeRedisCache(options =>
        {
            options.Configuration = "localhost:6379"; // Redis server address
            options.InstanceName = "SampleInstance";
        });

        services.AddSession(options =>
        {
            options.IdleTimeout = TimeSpan.FromMinutes(30);
            options.Cookie.HttpOnly = true;
            options.Cookie.IsEssential = true;
        });

        services.AddControllers();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        // ....

        app.UseSession(); // Enable session handling

        // ....
    }
} 

3) Client-Side Token-Based Session Management: Uses JWT tokens to manage session state client-side. In token-based authentication, session data can be stored in a secure token (e.g., JWT – JSON Web Token) and sent with each request.

Steps:

• Generate a token when the user logs in.
• Include the token in the Authorization header of each request.
• Validate the token on the server to retrieve the session data.

public class TokenController : ControllerBase
{
    [HttpPost("token")]
    public IActionResult GetToken([FromBody] UserLogin login)
    {
        if (IsValidUser(login))
        {
            var token = GenerateJwtToken(login);
            return Ok(new { token });
        }
        return Unauthorized();
    }

    private string GenerateJwtToken(UserLogin login)
    {
        var claims = new[]
        {
            new Claim(JwtRegisteredClaimNames.Sub, login.Username),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
        };

        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_secret_key"));
        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var token = new JwtSecurityToken(
            issuer: "yourdomain.com",
            audience: "yourdomain.com",
            claims: claims,
            expires: DateTime.Now.AddMinutes(30),
            signingCredentials: creds);

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

    private bool IsValidUser(UserLogin login)
    {
        // Validate the user credentials
        return true;
    }
} 

[ApiController]
[Route("api/[controller]")]
[Authorize] // Ensure token validation
public class SecureDataController : ControllerBase
{
    [HttpGet]
    public IActionResult GetSecureData()
    {
        return Ok("This is secured data accessible via a valid token");
    }
} 

4) Using Cookies: Although not common in Web APIs, you can use cookies to store session data on the client-side. This method can be combined with server-side session storage or token-based authentication.

public class SessionController : ControllerBase
{
    [HttpGet("set")]
    public IActionResult SetCookie(string key, string value)
    {
        CookieOptions option = new CookieOptions
        {
            Expires = DateTime.Now.AddMinutes(30)
        };
        Response.Cookies.Append(key, value, option);
        return Ok("Cookie value set");
    }

    [HttpGet("get")]
    public IActionResult GetCookie(string key)
    {
        var value = Request.Cookies[key];
        return Ok(value ?? "Cookie value not found");
    }
} 

Each method has its use case depending on the application’s architecture, scalability, and security requirements.

How do you implement HTTP method overrides in Web API?

HTTP method overrides are used to allow clients to “override” the HTTP method of a request, typically when the client is limited to using certain HTTP methods like POST but needs to perform other operations like PUT. This is commonly achieved by using a special HTTP header X-HTTP-Method-Override.

public class Startup
{
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        // Enable the HTTP Method Override middleware
        app.UseHttpMethodOverride();
    }
} 

POST /api/products/1 HTTP/1.1
Host: example.com
X-HTTP-Method-Override: PUT
Content-Type: application/json

{
    "name": "Updated Product Name"
} 

What is form-data?

Form-data is a format used to send key-value pairs, including files, from a client (like a web browser) to a server, typically in an HTTP POST request. It’s commonly used for submitting forms that include file uploads.

Different between IFormFile and [FormForm].

IFormFile and [FormForm] are often used when a client sends a file or data using ‘multipart/form-data’ content type POST request, which is typically used when submitting forms with files or mixed data (multipart file uploads). Here are the differences:

[HttpPost("uploadfile")]
public async Task<IActionResult> UploadFile(IFormFile file)
{
} 

[HttpPost("uploadfiles")]
public async Task<IActionResult> UploadFiles([FromForm] UploadModel model)
{
} 

How do you upload and download files in a Web API?

1) File Uploading: Use IFormFile or [FromForm] as an action method parameter to upload files and store them on the server using a FileStream.

a. Using IFormFile Interface: IFormFile handles file uploads from the HTTP request and provides a way to access the uploaded file’s metadata (like file name and content type). For multiple file uploads use List<IFormFile>

[HttpPost("upload")]
public async Task<IActionResult> UploadFile(IFormFile file)
{
	if (file != null && file.Length > 0)
	{
		var filePath = Path.Combine("uploads", file.FileName);

		// Ensure the directory exists
		if (!Directory.Exists("uploads"))
		{
			Directory.CreateDirectory("uploads");
		}

		using (var stream = new FileStream(filePath, FileMode.Create))
		{
			await file.CopyToAsync(stream);
		}

		return Ok(new { message = "File uploaded successfully!" });
	}

	return BadRequest("File is required.");
} 

b. Using [FromForm] attribute: [FromForm] binds form data (fields & file uploads) to action method parameters. IFormFile is used in conjunction with [FromForm] to handle file uploads along with other form data.

public class UploadModel
{
    // multiple file upload
    public List<IFormFile> Files { get; set; }

    public string ProductCode { set; get; }
} 

[HttpPost("uploadfiles")]
public async Task<IActionResult> UploadFiles([FromForm] UploadModel model)
{
	if (CloudStorageAccount.TryParse(config.Value.StorageConnection, out CloudStorageAccount storageAccount))
	{
		CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();
		CloudBlobContainer container = blobClient.GetContainerReference(config.Value.Container);
		await container.CreateIfNotExistsAsync();

		CloudBlobDirectory recipefolder = container.GetDirectoryReference("Recipe");
		await recipefolder.Container.CreateIfNotExistsAsync();
		
		List<IFormFile> files = model.Files;
		
		Parallel.ForEach(files, file =>
		{
			CloudBlockBlob blob = recipefolder.GetBlockBlobReference(file.FileName);
			blob.UploadFromStreamAsync(file.OpenReadStream());
		});

	}
} 

2) File Downloading:

To allow clients to download a file, read the file from the server using FileStream and use the base File() method to return a file stream as an IActionResult with the appropriate content type.

[HttpGet("download/{fileName}")]
public async Task<IActionResult> DownloadFile(string fileName)
{
    var filePath = Path.Combine("uploads", fileName);

    if (!System.IO.File.Exists(filePath))
    {
        return NotFound(new { message = "File not found." });
    }

    var memory = new MemoryStream();
    using (var stream = new FileStream(filePath, FileMode.Open))
    {
        await stream.CopyToAsync(memory);
    }
    memory.Position = 0;

    return File(memory, GetContentType(filePath), Path.GetFileName(filePath));
	

    // To download file from Azure Blob Storage
    // CloudBlob file = recipefolder.GetBlobReference(recipe.Recipe_Name);
    // if (await file.ExistsAsync())
    // {
    //    await file.DownloadToStreamAsync(ms);
    //    Stream blobStream = file.OpenReadAsync().Result;
    //    return File(blobStream, file.Properties.ContentType, file.Name);
    // }
}


private string GetContentType(string path)
{
    var types = new Dictionary<string, string>
    {
        {".txt", "text/plain"},
        {".pdf", "application/pdf"},
        {".doc", "application/vnd.ms-word"},
        {".docx", "application/vnd.ms-word"},
        {".xls", "application/vnd.ms-excel"},
        {".xlsx", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"},
        {".png", "image/png"},
        {".jpg", "image/jpeg"},
        {".jpeg", "image/jpeg"},
        {".gif", "image/gif"},
        {".csv", "text/csv"}
    };

    var ext = Path.GetExtension(path).ToLowerInvariant();
    return types.ContainsKey(ext) ? types[ext] : "application/octet-stream";
} 

How do you Encode and Decode a URL or text?

Handling URL encoding and decoding ensures that special characters in the URL or text are properly processed. You can use System.Net.WebUtility or System.Uri classes.

1) URL Encoding: Converts special characters in a URL or text into a format that can be transmitted over the Internet. For example, spaces are replaced with %20.

string encodedUrl = WebUtility.UrlEncode("https://example.com/search?query=hello world");

// Output: https%3A%2F%2Fexample.com%2Fsearch%3Fquery%3Dhello%20world

2) URL Decoding: Reverts the encoded URL back to its original form, making it readable and usable in the application.

string decodedUrl = WebUtility.UrlDecode("https%3A%2F%2Fexample.com%2Fsearch%3Fquery%3Dhello%20world");

// Output: https://example.com/search?query=hello world

What is the difference between Transient, Scoped, and Singleton services in Web API?

public void ConfigureServices(IServiceCollection services)
{
    services.AddTransient<ITransientService, TransientService>();
    services.AddScoped<IScopedService, ScopedService>();
    services.AddSingleton<ISingletonService, SingletonService>();
} 

What is API rate limiting and how can it be implemented in Web API applications?

API rate limiting is a technique used to control the number of requests a client can make to an API within a specified time period. This helps prevent abuse, ensures fair usage, and protects the API from getting overloaded with too many requests. Rate limiting can be crucial for maintaining the performance, reliability, and security of an API. You can implement rate limiting using custom middleware.

public class RateLimitingMiddleware
{
    private readonly RequestDelegate _next;
    private static readonly Dictionary<string, int> ClientRequestCounts = new Dictionary<string, int>();
    private static readonly TimeSpan TimeWindow = TimeSpan.FromMinutes(1);
    private const int MaxRequestsPerWindow = 10;

    public RateLimitingMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        var clientIp = context.Connection.RemoteIpAddress?.ToString();

        if (clientIp != null)
        {
            if (ClientRequestCounts.ContainsKey(clientIp))
            {
                ClientRequestCounts[clientIp]++;
            }
            else
            {
                ClientRequestCounts[clientIp] = 1;
            }

            if (ClientRequestCounts[clientIp] > MaxRequestsPerWindow)
            {
                context.Response.StatusCode = 429; // Too Many Requests
                await context.Response.WriteAsync("Rate limit exceeded. Try again later.");
                return;
            }
        }

        await _next(context);
    }
} 

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseMiddleware<RateLimitingMiddleware>();

    // ....
} 

How do you ensure backward compatibility when updating a Web API?

To ensure backward compatibility when updating a Web API, follow these practices:

1. Versioning the API: Introduce new versions of your API rather than changing existing endpoints. Use versioning strategies like URL versioning (e.g., /api/v2/resource), query string parameters (e.g., /api/resource?version=2), or custom headers (e.g., api-version: 2.0).
2. Deprecate Endpoints Gradually: Inform users in advance about deprecated endpoints or features. Provide a transition period where both the old and new versions are available.
3. Add New Endpoints Instead of Modifying Existing Ones: Add new functionality through new endpoints rather than modifying the behavior of existing ones.
4. Maintain Schema Compatibility: Ensure that changes to data structures (like adding new fields) are backward-compatible. Avoid removing or renaming existing fields in responses.
5. Use Default Values for New Fields: When adding new fields to API responses or requests, provide default values so that old clients can continue working without changes.
6. Contract Testing: Use contract tests to ensure that changes in the API do not break existing clients.
7. Document Changes Clearly: Update the API documentation to reflect the changes, specifying the differences between versions and the impact on clients.

What is DTO (Data Transfer Objects)? How do you create and use DTOs in Web API?

DTO (Data Transfer Objects) is a simple object that ensures only necessary data is transferred across different layers of an application, particularly between the client and server in a Web API. DTOs typically contain only the data needed by the client, excluding any unnecessary or sensitive information.

1) Creating DTOs: Let’s say you have a Product entity class with several properties and it exposes some internal & sensitive information, as shown in the example:

public class Product
{
    public int Id { get; set; }
    public string Name { get; set; }
    public decimal Price { get; set; }
    public DateTime CreatedDate { get; set; }  // Internal information
    public string InternalCode { get; set; }  // Sensitive information
} 

2) You can create a ProductDTO to show only the necessary fields required & applicable to the client, as shown in the example:

public class ProductDTO
{
    public int Id { get; set; }
    public string Name { get; set; }
    public decimal Price { get; set; }
} 

3) Using DTOs in Web API: Once you have created DTO, you can use it in your Web API actions to ensure that only the required data is sent to or received from the client, as shown in the example:

// Sample Web API Controller
[ApiController]
[Route("api/[controller]")]
public class ProductsController : ControllerBase
{
    // Suppose you have a method to get a product by Id
    [HttpGet("{id}")]
    public ActionResult<ProductDTO> GetProduct(int id)
    {
        // Fetch the product from the database
		var productDTO =_context.TProduct  
							.Where(p => p.Id == Id)

							// Convert the Product to ProductDTO before returning it
							.Select(s => new ProductDTO
							{
								Id = s.Id,
								Name = s.Name,
								Price = s.Price
							});

        return Ok(productDTO);
    }

    // A method to create a new product using a DTO
    [HttpPost]
    public IActionResult CreateProduct(ProductDTO productDTO)
    {
        // Convert the DTO to the Product entity
        var product = new Product
        {
            Id = new Random().Next(1, 1000),  // Just for example
            Name = productDTO.Name,
            Price = productDTO.Price,
            CreatedDate = DateTime.UtcNow,
            InternalCode = "DEF456"  // Example of internal code generation
        };

        // Save the product to the database (code omitted)
        
        return CreatedAtAction(nameof(GetProduct), new { id = product.Id }, productDTO);
    }
} 

How do you implement API response compression in Web API?

Implementing API response compression in a Web API can significantly reduce the size of the data sent over the network, leading to faster response times and reduced bandwidth usage. .NET Core provides built-in middleware for response compression, which can be added to your application in the Startup.cs file. Gzip and Brotli are commonly used compression algorithms supported by .NET Core. Here’s how you can implement response compression in a .NET Core Web API:

1) Install the Required Package: If it’s not already included in your project, you may need to install Microsoft.AspNetCore.ResponseCompression package.

2) Configure Response Compression in Startup.cs:

2.a) In the ConfigureServices method, add and configure the response compression middleware.

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers();

    // Add response compression services
    services.AddResponseCompression(options =>
    {
        options.EnableForHttps = true; // Enable compression even for HTTPS requests
        options.Providers.Add<GzipCompressionProvider>(); // Add GZIP compression
        options.Providers.Add<BrotliCompressionProvider>(); // Add Brotli compression
    });

    // Optional: Configure the compression level (e.g., optimal, fast, etc.)
    services.Configure<BrotliCompressionProviderOptions>(options =>
    {
        options.Level = System.IO.Compression.CompressionLevel.Fastest;
    });

    services.Configure<GzipCompressionProviderOptions>(options =>
    {
        options.Level = System.IO.Compression.CompressionLevel.Optimal;
        // or 
        // options.Level = System.IO.Compression.CompressionLevel.SmallestSize; 
    });
} 

2.b) In the Configure method, add the UseResponseCompression middleware to the request pipeline.

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // ....

    app.UseHttpsRedirection();

    // Add response compression to the pipeline
    app.UseResponseCompression();

    app.UseRouting();

    // ....
} 

3) Verify Compression in a Response: Once configured, the Web API will automatically compress responses based on the client’s Accept-Encoding header. Clients that support compression will receive compressed responses (e.g., gzip or brotli), while others will receive uncompressed data.

When you make a request to your Web API, you can verify that compression is working by checking the Content-Encoding header in the response.

If compression is applied, you should see a Content-Encoding: gzip header in the response.

read more: Response compression (learn.microsoft.com)

How do you manage environment-specific configurations in Web API?

Managing environment-specific configurations ensures the application behaves correctly in different environments, such as Development, Staging, and Production. Here are some basic steps:

• Use appsettings.json Files: ASP.NET Core uses appsettings.json to store configuration settings. You can create different versions of this file for each environment:
  • appsettings.json: Base configuration file.
  • appsettings.Development.json: Configuration specific to the Development environment.
  • appsettings.Staging.json: Configuration specific to the Staging environment.
  • appsettings.Production.json: Configuration specific to the Production environment.
• Load Environment-Specific Settings: ASP.NET Core automatically loads the appropriate appsettings file based on the current environment. The environment is specified by the ASPNETCORE_ENVIRONMENT environment variable.
  ▼ Show example

  using Microsoft.Extensions.Configuration;
  
  var builder = WebApplication.CreateBuilder(args);
  
  // Load base appsettings.json
  builder.Configuration
      .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true)
      // Load environment-specific appsettings.{EnvironmentName}.json
      .AddJsonFile($"appsettings.{builder.Environment.EnvironmentName}.json", optional: true, reloadOnChange: true)
      // Optionally load settings from environment variables
      .AddEnvironmentVariables();
  
  var app = builder.Build();
  
  // Example: Use the configuration
  var connectionString = builder.Configuration.GetConnectionString("DefaultConnection");
  Console.WriteLine($"Connection String: {connectionString}");
  
  app.Run(); 

• Use Environment Variables: You can override settings in the appsettings.json files with environment variables. This is particularly useful for secrets like connection strings.
  ▼ Show example

  ASPNETCORE_ENVIRONMENT=Production
  ConnectionStrings__DefaultConnection=Server=myprodserver;Database=MyAppDbProd;User Id=myusername;Password=mypassword; 

read more: Use multiple environments (learn.microsoft.com)

How do you implement request and response logging?

Middleware allows you to intercept and log the HTTP requests and responses as they pass through the pipeline. The logs will include information such as the HTTP method, the URL, and the response status code. The example shows:

• Creating a Custom Middleware for Logging.
• During logging, the response body is temporarily copied to a MemoryStream to allow logging without affecting the original response stream.
• Registering the Middleware.
• Example Output.

public class RequestResponseLoggingMiddleware
{
    private readonly RequestDelegate _next;
    private readonly ILogger<RequestResponseLoggingMiddleware> _logger;

    public RequestResponseLoggingMiddleware(RequestDelegate next, ILogger<RequestResponseLoggingMiddleware> logger)
    {
        _next = next;
        _logger = logger;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // Log Request
        _logger.LogInformation("Handling request: {method} {url}", context.Request.Method, context.Request.Path);

        // Copy original response body stream
        var originalBodyStream = context.Response.Body;

        using (var responseBody = new MemoryStream())
        {
            context.Response.Body = responseBody;

            await _next(context); // Call the next middleware in the pipeline

            // Log Response
            _logger.LogInformation("Response: {statusCode}", context.Response.StatusCode);

            await responseBody.CopyToAsync(originalBodyStream);
        }
    }
} 

public class Startup
{
	public void ConfigureServices(IServiceCollection services)
	{
		// ....
		services.AddLogging();
		// ....
	}

	public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
	{
		// ....
		app.UseMiddleware<RequestResponseLoggingMiddleware>();
		// ....
	}
} 

info: RequestResponseLoggingMiddleware[0]
      Handling request: GET /api/values
info: RequestResponseLoggingMiddleware[0]
      Response: 200 

How do you use ApiExplorer to generate metadata about Web API endpoints?

ApiExplorer is a feature in ASP.NET Core that provides metadata about your Web API endpoints, such as route information, HTTP methods, and parameter details. This metadata can be used for various purposes, including generating API documentation with tools like Swagger. By default, ApiExplorer is enabled for controllers in an ASP.NET Core.

You can access the ApiExplorer metadata programmatically through dependency injection using the IApiDescriptionGroupCollectionProvider interface, which provides a collection of ApiDescriptionGroup, where each group contains metadata about the API controllers and their actions. ApiDescription represents a single API endpoint, including details like the HTTP method, route, and parameters. Here’s an example of how to access it within a controller:

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.ApiExplorer;

[ApiController]
[Route("api/[controller]")]
public class MetadataController : ControllerBase
{
    private readonly IApiDescriptionGroupCollectionProvider _apiDescriptionGroupCollectionProvider;

    public MetadataController(IApiDescriptionGroupCollectionProvider apiDescriptionGroupCollectionProvider)
    {
        _apiDescriptionGroupCollectionProvider = apiDescriptionGroupCollectionProvider;
    }

    [HttpGet("endpoints")]
    public IActionResult GetApiEndpoints()
    {
        var apiDescriptions = _apiDescriptionGroupCollectionProvider.ApiDescriptionGroups
             .Items
             .SelectMany(group => group.Items)
             .Select(apiDesc => new
             {
                 HttpMethod = apiDesc.HttpMethod,
                 RelativePath = apiDesc.RelativePath,
                 ActionName = apiDesc.ActionDescriptor.DisplayName,
                 Parameters = apiDesc.ParameterDescriptions.Select(param => new
                 {
                     param.Name,
                     param.Type,
                     param.Source
                 })
             });

        return Ok(apiDescriptions);
    }
} 

Tools like Swagger (using Swashbuckle or NSwag) can automatically use ApiExplorer metadata to generate interactive API documentation.

read full post: How to Add Swagger in Web API .net core?

How do you configure CORS policy for different environments?

To apply different Cross-Origin Resource Sharing (CORS) policies for different environments (e.g., Development, Staging, Production) in a Web API ASP.NET Core, you can define environment-specific settings in your Startup.cs file. Here are the steps to configure CORS:

1) Add CORS Services: First, you need to add CORS services in the ConfigureServices method and configure different CORS policies for each environment.

2) Apply the CORS Policy Based on the Environment: In the Configure method, apply the appropriate CORS policy based on the environment in which the application is running.

public class Startup
{
	public void ConfigureServices(IServiceCollection services)
	{
		// Add CORS services
		services.AddCors(options =>
		{
			options.AddPolicy(name: "DevelopmentCorsPolicy", builder =>
			{
				builder.WithOrigins("http://localhost:58794",
									"http://localhost:58794/")
						.AllowAnyOrigin()
						.AllowAnyMethod()
						.AllowAnyHeader();
			});

			options.AddPolicy(name: "ProductionCorsPolicy", builder =>
			{
				builder.WithOrigins("https://your-production-site.com")
					   .AllowAnyMethod()
					   .AllowAnyHeader();
			});
		});
	}

	public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
	{
		// Apply the CORS Policy
		if (env.IsDevelopment())
		{
			app.UseCors("DevelopmentCorsPolicy");
		}
		else if (env.IsProduction())
		{
			app.UseCors("ProductionCorsPolicy");
		}
	}
} 

How do you handle large data sets in Web API?

Here are some strategies to manage large data sets effectively:

1. Pagination: Breaks data into manageable pages.
2. Lazy Loading: Loads data only when needed.
3. Filtering: Narrows down the data set.
4. Sorting: Orders data for easier navigation.
5. Data Streaming: Sends data as it’s processed.
6. Compression: Reduces the size of data sent over the network.
7. Asynchronous Processing: Improves responsiveness.
8. Caching: Reduces database load for frequently requested data.

What is the difference between synchronous and asynchronous operations in Web API?

[HttpGet]
public IActionResult GetData()
{
    var data = _context.Data.ToList();  // This is a synchronous call
    return Ok(data);
} 

[HttpGet]
public async Task<IActionResult> GetDataAsync()
{
    var data = await _context.Data.ToListAsync();  // This is an asynchronous call
    return Ok(data);
} 

How do you ensure the security of sensitive data in Web API responses?

Here are several strategies to achieve this:

• Use HTTPS and Encrypt Sensitive Data.
• Restrict Data by implementing Role-Based Access.
• Use DTOs (Data Transfer Objects) and expose only necessary fields or data.
• Implement detailed logging and auditing of API requests and responses, especially when sensitive data is accessed.
• Regularly review logs to detect and respond to any suspicious activity.
• Implement Content Security Policy (CSP) headers to help prevent cross-site scripting (XSS) attacks, which can lead to the exposure of sensitive data.
• Ensure Input Validation, incoming requests are properly validated and sanitized to prevent injection attacks.
• Add security headers like X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, etc., to protect against common web vulnerabilities.

What are cross-cutting concerns in Web API, and how do you address them?

Cross-cutting concerns in a Web API are aspects of the application that affect multiple layers or components of the application. These concerns are not specific to any one piece of functionality but are needed across different parts of the system. Examples of cross-cutting concerns include logging, authentication, authorization, error handling, data validation, caching, exception handling, Response Formatting, and Rate Limiting.

Different ways to address Cross-Cutting Concerns:

1. Configuring Middleware: It allows you to execute code before and after the request is processed by the application. For example, you can implement logging, authentication, and error handling as middleware components.
2. Creating Filters: Filters like AuthorizationFilter, ActionFilter, ExceptionFilter, and ResultFilter that can be applied at the controller or action level.
3. Implementing Dependency Injection (DI): Use DI to manage dependencies such as logging services, authentication handlers, and configuration services.
4. Applying Attributes: You can create a custom [ValidateModel] attribute to enforce model validation.
5. Global Configuration: Configure global settings in the Startup.cs files like response formatting and security policies.

What is the role of IServiceCollection in configuring Web API services?

IServiceCollection is used to register and configure services that the application will use during its runtime. This registration is typically done in the Startup.cs file as part of the application’s dependency injection (DI) setup.

Key Roles of IServiceCollection:

• Service Registration: It is used to register services with different lifetimes (e.g., singleton, scoped, transient) that your application depends on. This allows you to inject these services into controllers, middleware, or other services as needed.
• Middleware and Framework Services: It is used to register framework services, such as authentication, authorization, logging, and configuration services.
• Dependency Injection (DI): It facilitates the Dependency Injection (DI) pattern allowing you to register services and configure how they should be resolved.
• Extensibility: The IServiceCollection interface is extensible, allowing you to add custom service registration extensions. This is often used in third-party libraries or to encapsulate complex service registrations into simple extension methods.

How do you implement a custom JSON converter in Web API?

To implement a custom JSON converter in a Web API, you can create a custom JSON converter by inheriting from the JsonConverter class in .NET. This allows you to control how specific types are serialized and deserialized to and from JSON.

Steps to Implement a Custom JSON Converter:

1. Create a Custom JsonConverter: Create a class that inherits from JsonConverter<T>, where T is the type you want to customize the serialization and deserialization process for. Override the Read and Write methods to define the custom logic.
   ▼ Show example

   public class CustomDateTimeConverter : JsonConverter<DateTime>
   {
       private readonly string _format;
   
       public CustomDateTimeConverter(string format)
       {
           _format = format;
       }
   
       public override DateTime Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
       {
           return DateTime.ParseExact(reader.GetString(), _format, null);
       }
   
       public override void Write(Utf8JsonWriter writer, DateTime value, JsonSerializerOptions options)
       {
           writer.WriteStringValue(value.ToString(_format));
       }
   } 

2. Register the Custom Converter: Register the custom JSON converter globally in the Startup.cs file.
   ▼ Show example

   public class Startup
   {
       public void ConfigureServices(IServiceCollection services)
       {
           services.AddControllers()
               .AddJsonOptions(options =>
               {
                   options.JsonSerializerOptions.Converters.Add(new CustomDateTimeConverter("yyyy-MM-dd"));
               });
       }
   
       // Other methods
   } 

3. Use the Custom Converter in a Specific Property: If you want to use the custom converter for specific properties rather than globally, you can apply the [JsonConverter] attribute to the property.
   ▼ Show example

   public class MyModel
   {
       public string Name { get; set; }
   
       [JsonConverter(typeof(CustomDateTimeConverter), "yyyy-MM-dd")]
       public DateTime DateOfBirth { get; set; }
   } 

How do you handle streaming responses in Web API?

Streaming can be handled using the Controller’s base File() method or FileStreamResult class.

FileStreamResult can be used to stream a file from the server to the client without loading the entire file into memory.

In the same way, the File method has several overloads that also accept a Stream as an input parameter and return a FileStreamResult.

[HttpGet("download-file")]
public IActionResult DownloadFile()
{
    var filePath = "path/to/large/file.zip";
    var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read);
    return new FileStreamResult(stream, "application/octet-stream")
    {
        FileDownloadName = "file.zip"
    };
} 

[HttpGet("DownloadFile/{Id}")]
public async Task<IActionResult> DownloadFileAsync(int Id)
{
    if (recipe != null)
    {
		MemoryStream ms = new MemoryStream();
		CloudBlob file = // get file from azure

		if (await file.ExistsAsync())
		{
			await file.DownloadToStreamAsync(ms);
			Stream blobStream = file.OpenReadAsync().Result;
			return File(blobStream, file.Properties.ContentType, file.Name);
		}
    }
} 

How do you use the ProblemDetails class for standardized error responses?

The ProblemDetails class is used to provide standardized error responses that conform to the ‘RFC 7807’ specification for problem details. This helps create consistent and informative error responses across your API.

[HttpGet("example")]
public IActionResult GetExample()
{
    if (/* some error condition */)
    {
        var problemDetails = new ProblemDetails
        {
            Status = StatusCodes.Status400BadRequest,
            Title = "Invalid request",
            Detail = "The request parameters are not valid.",
            Instance = HttpContext.Request.Path
        };

        return BadRequest(problemDetails);
    }

    // Normal response
    return Ok();
} 

public class CustomProblemDetails : ProblemDetails
{
    public string ErrorCode { get; set; }
    public string[] ErrorMessages { get; set; }
}

[HttpGet("custom-example")]
public IActionResult GetCustomExample()
{
    var problemDetails = new CustomProblemDetails
    {
        Status = StatusCodes.Status400BadRequest,
        Title = "Validation Error",
        Detail = "One or more validation errors occurred.",
        Instance = HttpContext.Request.Path,
        ErrorCode = "VAL123",
        ErrorMessages = new[] { "Field1 is required.", "Field2 must be a valid email address." }
    };

    return BadRequest(problemDetails);
} 

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseExceptionHandler(config =>
    {
        config.Run(async context =>
        {
            var exception = context.Features.Get<IExceptionHandlerFeature>()?.Error;
            var problemDetails = new ProblemDetails
            {
                Status = StatusCodes.Status500InternalServerError,
                Title = "An unexpected error occurred.",
                Detail = exception?.Message,
                Instance = context.Request.Path
            };

            context.Response.StatusCode = StatusCodes.Status500InternalServerError;
            context.Response.ContentType = "application/problem+json";

            await context.Response.WriteAsJsonAsync(problemDetails);
        });
    });

    // Other middlewares...
} 

How do you implement background services in ASP.NET Core Web API?

Background services can be implemented using the IHostedService interface or by deriving from the BackgroundService class. Background services are long-running processes that can execute independently of the main web request processing pipeline.

When to use?

• Processing Queue Messages: Continuously process messages from a queue.
• Scheduled Tasks: Perform periodic tasks like clearing caches or sending notifications.
• Polling Services: Poll external services or APIs for updates.

Steps to Implement a Background Service:

1. Create a Background Service Class: Implement the IHostedService interface or derive from BackgroundService.
2. Override the ExecuteAsync Method: The ExecuteAsync method contains the logic for the background task. It runs in the background and is called when the service starts.
3. Register the Background Service: Register the background service in the Dependency Injection (DI) Container using AddHostedService<T>() in the Startup.cs file.

using System;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;

public class MyBackgroundService : BackgroundService
{
    private readonly ILogger<MyBackgroundService> _logger;

    public MyBackgroundService(ILogger<MyBackgroundService> logger)
    {
        _logger = logger;
    }

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        _logger.LogInformation("MyBackgroundService is running.");

        while (!stoppingToken.IsCancellationRequested)
        {
            _logger.LogInformation("Doing background work...");
            await Task.Delay(1000, stoppingToken); // Simulate work
        }

        _logger.LogInformation("MyBackgroundService is stopping.");
    }
} 

public class Startup
{
	public void ConfigureServices(IServiceCollection services)
	{
		services.AddHostedService<MyBackgroundService>();
	}
} 

How do you implement HTTP/2 in Web API?

Implementing HTTP/2 in an ASP.NET Core Web API application primarily involves configuring the server to support the HTTP/2 protocol. ASP.NET Core has built-in support for HTTP/2 on Kestrel, IIS, and other web servers.

Steps to Implement HTTP/2:

1. Configure Kestrel for HTTP/2 (Default Configuration): Kestrel, the default web server in ASP.NET Core, supports HTTP/2 out of the box when using HTTPS. Typically, no additional configuration is required, but you can customize the setup if needed.

public class Program
{
    public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.ConfigureKestrel(serverOptions =>
                {
                    // Optional: Configure Kestrel for HTTP/2
                    serverOptions.ListenAnyIP(5001, listenOptions =>
                    {
                        listenOptions.Protocols = Microsoft.AspNetCore.Server.Kestrel.Core.HttpProtocols.Http2;
                        listenOptions.UseHttps(); // HTTP/2 requires HTTPS
                    });
                });            
            });
} 

public class Startup
{
	public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
	{
		app.UseEndpoints(endpoints =>
		{
			endpoints.MapGet("/", () => "Hello, HTTP/2!");
		});
	}
} 

2. Configure IIS for HTTP/2: If hosting on IIS, HTTP/2 is automatically enabled if the following conditions are met:

• The application is served over HTTPS.
• The server runs on Windows Server 2016 or later, or Windows 10 or later.

No specific changes are needed in the application code.

3. Enable HTTP/2 for Other Servers: For other servers like Nginx or Apache, HTTP/2 must be enabled at the server level. Configuration may differ depending on the server.

4. Client Compatibility: Ensure that the clients consuming the API are compatible with HTTP/2.

Key Points:

• HTTPS Requirement: HTTP/2 requires HTTPS. Ensure SSL/TLS is properly configured.
• Automatic Fallback: If a client doesn’t support HTTP/2, the server automatically falls back to HTTP/1.1.
• Performance Benefits: HTTP/2 offers performance improvements like multiplexing, header compression, and more efficient resource loading.

You can configure HTTP/2 and HTTP/1.1 Fallback in Kestrel and this setup allows the server to handle both HTTP/2 and HTTP/1.1 requests, providing flexibility for clients with varying protocol support.

public class Program
{
    public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.ConfigureKestrel(serverOptions =>
                {
                    serverOptions.ListenAnyIP(5001, listenOptions =>
                    {
                        listenOptions.Protocols = Microsoft.AspNetCore.Server.Kestrel.Core.HttpProtocols.Http1AndHttp2;
                        listenOptions.UseHttps();
                    });
                });            
            });
} 

public class Startup
{
	public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
	{
		app.UseEndpoints(endpoints =>
		{
			endpoints.MapGet("/", () => "Hello, HTTP/2 with fallback to HTTP/1.1!");
		});
	}
}