ASP.NET Core
news

Six Requests a Minimal API Should Refuse, and Their Status Codes

How should a warehouse order API refuse illegal state changes, short stock, stale ETag writes and malformed JSON? The author builds a pick-pack-ship demo on .NET 10 Minimal APIs and EF Core 10, mapping each refusal to a specific status code, such as 409, 412 and 400. He also explains why an exact retry should return 200 instead of an error. A useful guide for anyone designing workflow endpoints.

How to Revoke a JWT Before It Expires in ASP.NET Core

ASP.NET Core validates a JWT by its signature and expiry, so a stolen token keeps working after a password change. The article walks through two fixes: short-lived access tokens paired with revocable refresh tokens, then a token_version check for immediate revocation. Every .NET developer running JWT-based APIs should know where the gap is and what each fix costs.

Six common ASP.NET Core Web API mistakes and the patterns to use instead

A developer who has maintained ASP.NET Core APIs for years lists six recurring problems: scattered try/catch blocks, unbounded list queries, ignored cancellation tokens, lost UTC kinds, late config failures and unprotected login endpoints. Each comes with a suggested pattern using .NET 10 and EF Core 10, noted to work on .NET 8 with small changes.

SetVaryByQuery Can Make ASP.NET Core Output Cache Serve Wrong Pages

The article explains how calling SetVaryByQuery in an ASP.NET Core output cache policy replaces the default vary-by-all-query-keys behavior. A policy that names only sort stops varying by page, so different pages can receive the same cached body. The author reproduces the bug with a small test and shows the fix.

Cache-Control Header Is Not Output Caching: A Handler Counter Test

The author compares a Cache-Control header with ASP.NET Core output caching using a handler counter. The header only instructs clients and proxies, so the handler ran on all ten calls, while output caching stored the response on the server and ran the handler once. It is a concrete warning for anyone who thinks a cache header caches on the server.

ASP.NET Core Authentication Endpoints: Why I Built AuthEndpoints

AuthEndpoints 4 is a library that adds ready-made authentication endpoints on top of ASP.NET Core Identity. A single AddPasswordAuth and MapPasswordAuth pair covers sign-up, sign-in, 2FA, passkeys and password recovery. It targets .NET 10 and is compared with the built-in MapIdentityApi.

Server-Timing Headers in ASP.NET Core: Backend Metrics in Browser DevTools

Maarten Balliauw shows how to add a Server-Timing response header in ASP.NET Core so database and external API timings appear in browser DevTools next to the network timings. The post builds a small middleware, a measurement feature that endpoints can use, and ways to reuse OpenTelemetry Activity data. It also covers gating the header so internal timings are not exposed to every caller.

How to Scale SignalR Applications Across Multiple Servers

This guide explains how to scale ASP.NET Core SignalR across several servers using either a Redis backplane or Azure SignalR Service. It covers why messages fail to reach clients on other servers, how each option distributes them, and when sticky sessions are still needed. It is a practical starting point for teams moving real-time apps into production.

Suppressing logs for cancelled HTTP requests with Scrutor

A Habr author describes how their ASP.NET Core team stopped logging OperationCanceledException when a client aborts an HTTP request. NLog filters and middleware catches fell short. The working approach decorates ILoggerProvider with Scrutor and checks HttpContext.RequestAborted before writing the entry.

Rate Limiting in ASP.NET Core: Four Algorithms Compared

A guide to the four built-in rate limiting algorithms in ASP.NET Core: fixed window, sliding window, token bucket and concurrency limiter. It shows how each one behaves under the same traffic and when to pick it for a given endpoint. Useful for any .NET developer who needs to protect an API from abusive or buggy clients.

Localize Minimal API validation messages in .NET 11

ASP.NET Core 11 adds built-in localization for validation messages and display names in Minimal APIs and Blazor. Registering AddValidation and AddLocalization, plus culture-specific resx files, is enough to return 400 responses in the caller's language. The author shows a working sample and an integration test across four cultures.

What I learned building an xAPI 2.0 library and LRS for .NET

The author built xapi-dotnet, an xAPI 2.0 (IEEE 9274.1.1) library with statement models, an async client, a durable outbox and an LRS that runs inside ASP.NET Core. The write-up covers conformance testing in CI, reflection-free JSON handling for Native AOT and Unity, and the real cost of durable writes. Useful for any team sending e-learning data from .NET.