### Authentication & Authorization Secure your API with JWT tokens: ```csharp // Program.cs builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidateAudience = true, ValidateLifetime = true, ValidIssuer = builder.Configuration["Jwt:Issuer"], ValidAudience = builder.Configuration["Jwt:Audience"], IssuerSigningKey = new SymmetricSecurityKey( Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!)) }; }); // Protect endpoints [Authorize] [HttpGet("profile")] public ActionResult GetProfile() { ... } [Authorize(Roles = "Admin")] [HttpDelete("{id}")] public async Task Delete(int id) { ... } ``` ### API Versioning Support multiple API versions: ```csharp builder.Services.AddApiVersioning(options => { options.DefaultApiVersion = new ApiVersion(1, 0); options.AssumeDefaultVersionWhenUnspecified = true; options.ReportApiVersions = true; }); // Version via URL [ApiController] [Route("api/v{version:apiVersion}/[controller]")] [ApiVersion("1.0")] [ApiVersion("2.0")] public class BooksController : ControllerBase { [HttpGet] public ActionResult> GetAll() { ... } [HttpGet] [MapToApiVersion("2.0")] public ActionResult> GetAllV2() { ... } } ``` ### Caching Improve performance with response caching: ```csharp // Output caching (ASP.NET Core 7+) builder.Services.AddOutputCache(options => { options.AddBasePolicy(builder => builder.Expire(TimeSpan.FromMinutes(5))); options.AddPolicy("Books", builder => builder.Expire(TimeSpan.FromMinutes(10)) .Tag("books")); }); [HttpGet] [OutputCache(PolicyName = "Books")] public async Task>> GetAll() { ... } // Invalidate cache [HttpPost] public async Task> Create(CreateBookDto dto) { var book = await _service.CreateAsync(dto); await _outputCacheStore.EvictByTagAsync("books", default); return CreatedAtAction(nameof(GetById), new { id = book.Id }, book); } ``` ```json { "question": "When should you invalidate a cache?", "options": ["Every request", "When data changes", "Never", "Only on GET requests"], "correct": 1 } ``` ### Rate Limiting Protect your API from abuse: ```csharp builder.Services.AddRateLimiter(options => { options.AddFixedWindowLimiter("fixed", config => { config.Window = TimeSpan.FromMinutes(1); config.PermitLimit = 100; config.QueueLimit = 10; }); options.RejectionStatusCode = StatusCodes.Status429TooManyRequests; }); app.UseRateLimiter(); [HttpGet] [EnableRateLimiting("fixed")] public async Task>> GetAll() { ... } ``` ### Logging and Observability Add structured logging: ```csharp // Use Serilog for structured logging builder.Host.UseSerilog((context, config) => { config.ReadFrom.Configuration(context.Configuration) .WriteTo.Console() .WriteTo.Seq("http://localhost:5341"); }); // Log in your services public class BookService : IBookService { private readonly ILogger _logger; public async Task CreateAsync(CreateBookDto dto) { _logger.LogInformation("Creating book {Title} for author {AuthorId}", dto.Title, dto.AuthorId); // ... } } ``` ### Health Checks Monitor API health: ```csharp builder.Services.AddHealthChecks() .AddDbContextCheck("database") .AddCheck("self", () => HealthCheckResult.Healthy()); app.MapHealthChecks("/health", new HealthCheckOptions { ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse }); ``` ```json { "question": "What is the purpose of health checks?", "options": ["Validate user input", "Monitor API and dependency status", "Authenticate users", "Cache responses"], "correct": 1 } ``` ### Background Jobs Process work asynchronously: ```csharp // Simple background service public class EmailNotificationService : BackgroundService { protected override async Task ExecuteAsync(CancellationToken stoppingToken) { while (!stoppingToken.IsCancellationRequested) { await ProcessPendingEmailsAsync(); await Task.Delay(TimeSpan.FromSeconds(30), stoppingToken); } } } // Or use a library like Hangfire builder.Services.AddHangfire(config => config.UseSqlServerStorage(connectionString)); BackgroundJob.Enqueue(() => SendWelcomeEmail(user.Email)); ``` ### API Documentation Enhance Swagger documentation: ```csharp builder.Services.AddSwaggerGen(options => { options.SwaggerDoc("v1", new OpenApiInfo { Title = "Bookstore API", Version = "v1", Description = "API for managing books and authors" }); // Include XML comments var xmlFile = $"{Assembly.GetExecutingAssembly().GetName().Name}.xml"; options.IncludeXmlComments(Path.Combine(AppContext.BaseDirectory, xmlFile)); // Add JWT auth to Swagger options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme { Description = "JWT Authorization header", Name = "Authorization", In = ParameterLocation.Header, Type = SecuritySchemeType.ApiKey, Scheme = "Bearer" }); }); ``` ### Testing Write tests for your API: ```csharp // Integration test public class BooksControllerTests : IClassFixture> { private readonly HttpClient _client; public BooksControllerTests(WebApplicationFactory factory) { _client = factory.CreateClient(); } [Fact] public async Task GetAll_ReturnsSuccessStatusCode() { var response = await _client.GetAsync("/api/books"); response.EnsureSuccessStatusCode(); } [Fact] public async Task Create_WithValidData_ReturnsCreated() { var dto = new CreateBookDto("Test Book", null, 19.99m, 2024, 1); var response = await _client.PostAsJsonAsync("/api/books", dto); Assert.Equal(HttpStatusCode.Created, response.StatusCode); } } ``` ```json { "question": "What type of test uses WebApplicationFactory?", "options": ["Unit test", "Integration test", "Load test", "Security test"], "correct": 1 } ```

Production Considerations

Production Considerations

What We've Covered