Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Unit Testing an ASP.NET Core Web API: Service and Controller Tests with xUnit and Moq
Unit testing an ASP.NET Core Web API with xUnit and Moq: the right package versions for net6.0, AAA and naming, Setup and Verify, the Result/Value difference in ActionResult<T> tests, Theory, and a comparison with NSubstitute.
Health Checks in ASP.NET Core Web API: Liveness, Readiness and Database Checks
Health checks in ASP.NET Core Web API: a database check with AddDbContextCheck, a Redis check with IHealthCheck, separating liveness and readiness, why Degraded returns 200, JSON output and timeout pitfalls.
Caching in ASP.NET Core Web API: IMemoryCache, Redis and Response Caching
Caching in ASP.NET Core Web API: absolute and sliding expiration with IMemoryCache, delete-on-write invalidation, IDistributedCache with Redis, and which requests the response caching middleware won't cache and why.
Swagger and OpenAPI in ASP.NET Core Web API: Documentation with Swashbuckle
We add an OpenAPI document and Swagger UI to an ASP.NET Core Web API with Swashbuckle: the right package version, XML comments, documenting response types, an Authorize button for JWT, and common pitfalls with real error messages.
ASP.NET Core Web API Versioning: URL, Query String and Header with Asp.Versioning
To ship breaking changes without breaking old clients, we build a two-version API with Asp.Versioning.Mvc. We try URL, query string and header readers, plus deprecation and the Sunset header.
CORS and Security in ASP.NET Core Web API: HTTPS, HSTS, Headers and Secrets
We see with curl why CORS is not a firewall, define a policy and read the preflight request. HTTPS redirection, the localhost exception in HSTS, security headers and user secrets are covered too.
Authorization in ASP.NET Core Web API: Roles, Policies and Resource-Based Authorization
We start with [Authorize] and FallbackPolicy, then move to roles, policies, our own requirement and handler, and resource-based authorization. We see the RoleClaimType trap and 401 vs 403 with curl.
Authentication with JWT in ASP.NET Core Web API: Issuing and Validating Tokens
From the authentication vs authorization split to the anatomy of a JWT, we build a login flow with AddJwtBearer and JsonWebTokenHandler. ClockSkew, claim mapping and the refresh token idea are covered too.
File Upload and Download in ASP.NET Core Web API: IFormFile, Limits and Streaming
We upload product images with IFormFile and guard against path traversal and fake extensions. We cover Kestrel and form limits, downloads with PhysicalFile and streaming with MultipartReader.
Pagination, Filtering and Sorting in ASP.NET Core Web API: Returning Large Lists Safely
We gather query parameters in one class and run filtering, the total count, Skip/Take and allow-listed dynamic sorting in the database with IQueryable. Plus body vs header metadata, offset vs keyset, and the SQLite decimal trap.
Filters in ASP.NET Core Web API: Action Filters, Result Filters and ServiceFilter
We take apart MVC's filter pipeline with real logs: the order of global, controller and action filters, ServiceFilter for an async filter that uses DI, short-circuiting with TypeFilter, result filters, and middleware versus filters.
Global Error Handling in ASP.NET Core: Exception Middleware and ProblemDetails
Starting from the real response of an unhandled exception on .NET 6, we move to UseExceptionHandler with an error controller, then to our own middleware that maps domain exceptions to 404/409/500 ProblemDetails.