أسئلة القسم

When to use:

MVC: For modern, testable, SEO-friendly apps requiring fine-grained HTML control. Web Forms: For rapid internal apps where drag-and-drop UI and server controls are desired.

• Routing – URL matched to route.
• Controller Initialization – Controller instance created.
• Action Execution – Action method runs.
• Result Execution – Action returns a result (often a ViewResult).
• View Rendering – Razor engine renders the View to HTML.

REST (Representational State Transfer) is an architectural style for building APIs. Uses HTTP verbs to perform CRUD operations on resources (nouns). Stateless: each request contains all info needed. Returns representations like JSON or XML.

Automated code generation feature. Quickly creates Controllers, Views, and CRUD actions from a Model. Saves time in prototyping.

A reusable Razor View chunk (like a UserControl). Does not run as a full view; rendered inside another view. Used for headers, footers, sidebars, or shared UI parts.

• ViewBag (dynamic, short-lived)
• ViewData (dictionary, short-lived)
• TempData (persists across redirect)
• Strongly-Typed Model (best practice)

Example:

public IActionResult Index() {
    var model = new ProductViewModel();
    return View(model); // strongly-typed
}

A simple object used to transfer data between layers or over the network. No business logic, just properties. Protects your domain models from exposure and reduces payload.

Applied to public methods in a Controller to prevent them from being treated as Actions. Ensures method can be called internally but not via HTTP request.

A piece of data (usually a string) used to authenticate or authorize a user. Examples: Session tokens, OAuth access tokens, JWTs. Carries claims/permissions instead of using cookies.

Open standard (RFC 7519) for secure transmission of claims. Consists of Header, Payload, Signature. Self-contained: server doesn’t store session state.

Routing: Matches incoming URL to endpoint (controller/action or Razor page). By default, uses convention-based routing defined in Program.cs. Attribute Routing: Decorating controllers/actions with [Route] to define URL patterns explicitly.

Components that handle requests/responses in a pipeline. Registered in Program.cs using app.Use....

Creating custom middleware:

public class MyMiddleware {
  private readonly RequestDelegate _next;
  public MyMiddleware(RequestDelegate next) => _next = next;

  public async Task Invoke(HttpContext context) {
    await _next(context);
  }
}
// In Program.cs
app.UseMiddleware<MyMiddleware>();

Request enters → passes each middleware in order → endpoint executes → response travels back through middlewares. Order matters.

Special attributes that run before or after controller actions. Used for cross-cutting concerns: logging, validation, caching.

Prevents Cross-Site Request Forgery (CSRF) attacks. Ensures request is from the authenticated user’s browser. ASP.NET Core: @Html.AntiForgeryToken() in view + [ValidateAntiForgeryToken] in action.

HTTP spec doesn’t set a hard limit. The web server or browser imposes limits:

• IIS default max URL length ≈ 16 KB.
• ASP.NET Core’s Kestrel has higher defaults but still limited by OS. POST body size can be configured (e.g. MaxRequestBodySize).

Kestrel: Cross-platform, lightweight, built-in web server for ASP.NET Core. Always used. IIS: Windows-only, full-featured web server.

How they work:

ASP.NET Core runs on Kestrel internally. On Windows, you often put IIS in front as a reverse proxy (handles SSL termination, process management). On Linux you’d use Nginx/Apache in front.

Alternate route name for the same endpoint using multiple [Route] attributes.

• Transient: New instance every time requested.
• Scoped: One instance per request.
• Singleton: One instance for the lifetime of the app.

Allows you to swap real implementations with mocks/fakes. Your code depends on interfaces, not concrete classes.

Central factory to create HttpClient instances. Solves socket exhaustion & DNS issues. Centralized config & resilience (policies, retries with Polly).

If you new HttpClient() repeatedly:

• OS sockets not released fast enough (socket exhaustion).
• DNS changes not respected. Recommended: one long-lived instance or use IHttpClientFactory.

Uses async/await to free threads during I/O operations. Increases scalability and responsiveness (especially for web apps). Doesn’t block the request thread.

Use Exception Filters (IExceptionFilter) for controller-level errors. Use middleware for global exception handling. Configure custom error pages in Program.cs with app.UseExceptionHandler().

• HTTPS only.
• Authentication (JWT, OAuth, API Keys).
• Authorization (roles, policies).
• Input validation + Anti-forgery where needed.
• Rate limiting / throttling.

• User sends credentials to Auth endpoint.
• Server validates and issues JWT (signed).
• Client stores JWT (localStorage, cookies).
• Client sends JWT in Authorization: Bearer header for each request.
• Server middleware validates token signature and claims.

• Server verifies signature with secret/public key.
• Checks issuer, audience, expiration claims.
• (Optional) Use TLS and extra device checks.

Yes. JWT is bearer token: anyone holding it can act as user until it expires. Mitigations: Short lifetimes + refresh tokens, revoke via blacklists.

• In-Memory Cache: per app instance.
• Distributed Cache: Redis/SQL for multi-server scenarios.
• Response Caching: caches entire HTTP responses.
• Output caching (new in .NET 8): caches action results.

[HttpPost("products")]
public IActionResult Create([FromBody] ProductDto dto) {
    // validate & save
    return CreatedAtAction(nameof(GetById), new { id = 1 }, dto);
}

public class MyMiddleware {
  private readonly RequestDelegate _next;
  public MyMiddleware(RequestDelegate next) => _next = next;

  public async Task Invoke(HttpContext context) {
    // pre logic
    await _next(context);
    // post logic
  }
}
// registration:
app.UseMiddleware<MyMiddleware>();

• URL versioning: /api/v1/products
• Query string: ?api-version=1.0
• Header versioning: X-Version:1
• Use Microsoft’s Asp.Versioning NuGet for built-in support.

Upload:

var blob = container.GetBlobClient("image.jpg");
await blob.UploadAsync(stream);

Retrieve:

var blob = container.GetBlobClient("image.jpg");
var download = await blob.DownloadAsync();

• dotnet new webapi
• Add Models
• Add DbContext (if needed)
• Add Controllers
• Configure DI and routing
• Test with Swagger.

var client = httpClientFactory.CreateClient();
var response = await client.GetAsync("https://api.example.com/data");
var content = await response.Content.ReadAsStringAsync();