Pick a focused question that fits your time, stack, and interview goal.
How much time do you have?
Show one-drill sessions you can finish now.
95 results across 1 active filter
Page 3 of 4
Maps an HTTP ETag precondition to EF Core rowversion and returns 412 when the representation is stale.
Explains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.
Explains why cached authorization decisions are risky and how to bound or invalidate permission-related cache safely.
Separates caller cancellation from a dependency timeout and maps expected downstream outcomes safely.
Explains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.
Explains what happens when roles or tenant membership change while access tokens still contain old claims.
Explains how App Service can resolve Key Vault references through managed identity and what to watch during rotation and environment setup.
Covers App Service app settings, environment-specific configuration, restarts, slot settings, and avoiding hard-coded production values.
Covers using managed identity and Microsoft Entra authentication for Azure SQL access from a .NET API.
Validates size and signature, writes under a generated storage key, and keeps untrusted files outside the public web root.
Explains upload UX, API boundaries, validation, progress, storage, scanning, failure handling, and safe download behavior.
Validates a bounded command set completely before applying all updates in one SaveChanges transaction.
Stores an idempotency key, request hash, and response in the same transaction as the created resource.
Verifies the exact request bytes, rejects stale signatures, deduplicates event ids, and queues processing durably.
Explains how to diagnose 401/403 spikes across token validation, identity provider issues, clock skew, deployment changes, and abuse.
Uses declarative infrastructure, reviewed plans, environment parameters, protected deployment identities, state management, and drift control without hiding operational risk.
Separates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.
Explains insecure direct object reference risks and how APIs enforce ownership, tenant scope, and authorization per resource.
Explains why request DTOs should expose only allowed fields and how server-owned fields stay protected.
Updates only public mutable fields and leaves ownership, status, and audit values server-controlled.
Secures webhooks, previews, imports, and remote-file fetches with destination policy, DNS and redirect defenses, egress controls, limits, and observability.
Maps a named capability to an ASP.NET Core policy and enforces it at the endpoint boundary.
Explains token storage, cookies, XSS, CSRF, and why browser UI never replaces server authorization.
Explains where secrets and tokens should live, what not to log, how rotation works, and how client storage changes risk.