Senior .NET / C# Interview: Complete Answer Guide (Q81–Q185)

// What you write:
async Task<string> GetUserAsync(int id)
{
    var user = await _db.Users.FindAsync(id);
    var orders = await _orderService.GetOrdersAsync(user.Id);
    return $"{user.Name} has {orders.Count} orders";
}

// What the compiler generates (simplified):
class GetUserAsync_StateMachine : IAsyncStateMachine
{
    public int _state = -1;          // which await we're at
    public int id;                    // captured parameter
    private User user;               // local vars survive across awaits
    private List<Order> orders;
    private TaskAwaiter<User> _awaiter1;
    private TaskAwaiter<List<Order>> _awaiter2;

    void MoveNext()
    {
        switch (_state)
        {
            case -1: // initial call
                _awaiter1 = _db.Users.FindAsync(id).GetAwaiter();
                if (!_awaiter1.IsCompleted) { _state = 0; return; } // suspend
                goto case 0;
            case 0: // resume after first await
                user = _awaiter1.GetResult();
                _awaiter2 = _orderService.GetOrdersAsync(user.Id).GetAwaiter();
                if (!_awaiter2.IsCompleted) { _state = 1; return; }
                goto case 1;
            case 1: // resume after second await
                orders = _awaiter2.GetResult();
                // complete the task with the result
        }
    }
}

// Library code — ALWAYS use ConfigureAwait(false)
// This prevents capturing a SynchronizationContext unnecessarily
public async Task<byte[]> DownloadAsync(string url)
{
    using var client = new HttpClient();
    return await client.GetByteArrayAsync(url).ConfigureAwait(false);
    // ConfigureAwait(false) = "don't capture context, resume on any thread pool thread"
    // If you omit this in a library and the caller has a UI context,
    // you risk deadlocks (see Q83)
}

// Application code — can omit ConfigureAwait(false)
// because you often DO need to resume on the original context
public async Task UpdateButtonAsync()
{
    var data = await _service.GetDataAsync(); // fine, UI thread needed after
    button.Text = data; // must be on UI thread
}

// The deadlock scenario (classic ASP.NET or WinForms):

// Controller (on UI/request thread, SynchronizationContext is active)
public ActionResult GetData()
{
    // .Result blocks the current thread, waiting for the Task
    var result = GetDataAsync().Result; // DEADLOCK
    return View(result);
}

private async Task<string> GetDataAsync()
{
    // await captures the SynchronizationContext
    // continuation needs to run on the SAME thread that .Result is blocking
    // → thread A waits for Task, Task waits for thread A → deadlock
    return await _db.GetAsync();
}

// Option 1: Go async all the way (correct)
public async Task<ActionResult> GetData()
{
    var result = await GetDataAsync();
    return View(result);
}

// Option 2: Use ConfigureAwait(false) in async method (breaks the deadlock)
private async Task<string> GetDataAsync()
{
    return await _db.GetAsync().ConfigureAwait(false);
    // continuation no longer needs the original context
}

// Option 3: GetAwaiter().GetResult() is still blocking — not a real fix
// but avoids AggregateException wrapping

// Real-world: processing incoming webhook events without blocking the HTTP handler

public class WebhookProcessor
{
    private readonly Channel<WebhookEvent> _channel;
    private readonly IEventHandler _handler;

    public WebhookProcessor(IEventHandler handler)
    {
        _handler = handler;
        // BoundedChannel limits memory — rejects or blocks producers if full
        _channel = Channel.CreateBounded<WebhookEvent>(new BoundedChannelOptions(1000)
        {
            FullMode = BoundedChannelFullMode.Wait,
            SingleWriter = false,
            SingleReader = false,
        });

        // Start background consumers
        for (int i = 0; i < 4; i++)
            _ = ConsumeAsync();
    }

    // Called by HTTP handler — fast, non-blocking
    public async ValueTask EnqueueAsync(WebhookEvent evt)
        => await _channel.Writer.WriteAsync(evt);

    // Background consumer — processes one at a time
    private async Task ConsumeAsync()
    {
        await foreach (var evt in _channel.Reader.ReadAllAsync())
        {
            await _handler.HandleAsync(evt);
        }
    }
}

// CONCURRENCY — one thread, multiple I/O tasks in flight
async Task ConcurrentExample()
{
    // These start simultaneously but a single thread manages them
    var t1 = _db.GetUserAsync(1);
    var t2 = _api.GetWeatherAsync("Oslo");
    var t3 = _cache.GetAsync("key");

    await Task.WhenAll(t1, t2, t3); // concurrent I/O
}

// PARALLELISM — multiple threads, CPU-bound work
void ParallelExample(List<Image> images)
{
    // Each image processed on a separate CPU core
    Parallel.ForEach(images, new ParallelOptions { MaxDegreeOfParallelism = 4 },
        image => ProcessImage(image)); // CPU-intensive
}

// WRONG: Using parallelism for I/O-bound work wastes threads
void BadPattern(List<int> ids)
{
    Parallel.ForEach(ids, id =>
    {
        // This blocks a thread per item — thread pool exhaustion
        var user = _db.GetUserAsync(id).Result;
    });
}

// EF Core tracking states:
// Detached → Added → Unchanged → Modified → Deleted

var user = await _context.Users.FindAsync(1); // state: Unchanged
// EF stored snapshot: { Name: "Alice", Email: "alice@example.com" }

user.Name = "Alicia"; // state: Modified (detected automatically)

await _context.SaveChangesAsync();
// Generates: UPDATE Users SET Name = 'Alicia' WHERE Id = 1
// Only the changed column — not the full row

// NoTracking — use for read-only queries (faster, less memory)
var readOnlyUser = await _context.Users
    .AsNoTracking()
    .FirstOrDefaultAsync(u => u.Id == 1);
// No snapshot stored, cannot be saved back

// SaveChanges approach — loads ALL matching users (N reads + 1 write)
var premiumUsers = await _context.Users
    .Where(u => u.Tier == "free" && u.CreatedAt < cutoff)
    .ToListAsync();  // SELECT — loads 50,000 rows into memory

foreach (var user in premiumUsers)
    user.Tier = "premium";

await _context.SaveChangesAsync(); // UPDATE 50,000 rows, one at a time

// ExecuteUpdateAsync — single SQL UPDATE, no entity loading
await _context.Users
    .Where(u => u.Tier == "free" && u.CreatedAt < cutoff)
    .ExecuteUpdateAsync(setters => setters
        .SetProperty(u => u.Tier, "premium")
        .SetProperty(u => u.UpdatedAt, DateTime.UtcNow));
// Generates: UPDATE Users SET Tier='premium', UpdatedAt=... WHERE Tier='free' AND CreatedAt < ...
// Zero entities loaded into memory

// Common use: soft deletes and multi-tenancy
protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    // Soft delete filter — automatically excludes deleted records
    modelBuilder.Entity<User>()
        .HasQueryFilter(u => !u.IsDeleted);

    // Multi-tenant filter — scoped to current tenant
    modelBuilder.Entity<Order>()
        .HasQueryFilter(o => o.TenantId == _tenantId);
}

// Every query now automatically filters:
var users = await _context.Users.ToListAsync();
// SELECT * FROM Users WHERE IsDeleted = 0  ← filter added automatically

// Bypass when needed:
var allUsers = await _context.Users.IgnoreQueryFilters().ToListAsync();

// N+1 — 1 query for orders + N queries for customers
var orders = await _context.Orders.ToListAsync();
foreach (var order in orders)
{
    // EF Core lazy loading fires a SELECT per order — 1000 orders = 1001 queries
    Console.WriteLine(order.Customer.Name);
}

// Fix 1: Eager loading with Include
var orders = await _context.Orders
    .Include(o => o.Customer)  // JOIN in a single query
    .ToListAsync();

// Fix 2: Split query (for large collections — avoids cartesian explosion)
var orders = await _context.Orders
    .Include(o => o.Customer)
    .Include(o => o.Items)    // Items could cause cartesian product
    .AsSplitQuery()           // EF Core 5+ — runs separate queries, joins in memory
    .ToListAsync();

// Fix 3: Projection (most efficient — only select needed columns)
var result = await _context.Orders
    .Select(o => new OrderDto
    {
        Id = o.Id,
        CustomerName = o.Customer.Name,  // EF translates to a JOIN
        ItemCount = o.Items.Count
    })
    .ToListAsync();

// Fix 4: Explicit loading (when you conditionally need related data)
var order = await _context.Orders.FindAsync(id);
if (needCustomer)
    await _context.Entry(order).Reference(o => o.Customer).LoadAsync();

// Domain model
public class User
{
    public int Id { get; set; }
    public string Name { get; set; }
    public Address HomeAddress { get; set; }  // owned entity
    public Address WorkAddress { get; set; }  // second instance
}

public class Address  // no Id — it's a value object
{
    public string Street { get; set; }
    public string City { get; set; }
    public string PostalCode { get; set; }
}

// Configuration
modelBuilder.Entity<User>().OwnsOne(u => u.HomeAddress, a =>
{
    a.Property(x => x.Street).HasColumnName("HomeStreet");
    a.Property(x => x.City).HasColumnName("HomeCity");
});
// Stored in Users table: HomeStreet, HomeCity, HomePostalCode columns

// Or in a separate table:
modelBuilder.Entity<User>().OwnsOne(u => u.HomeAddress, a =>
    a.ToTable("UserAddresses"));

Request
  → ExceptionHandlingMiddleware
    → HttpsRedirectionMiddleware
      → StaticFilesMiddleware
        → RoutingMiddleware
          → AuthenticationMiddleware
            → AuthorizationMiddleware
              → EndpointMiddleware (your controller action)
            ← [response flows back up]
          ←
        ←
      ←
    ←
  ←
Response

var app = builder.Build();

// Order matters — each Use() adds to the chain
app.UseExceptionHandler("/error");       // catches exceptions from everything below
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();                        // matches route to endpoint
app.UseAuthentication();                 // who are you?
app.UseAuthorization();                  // are you allowed?
app.MapControllers();                    // execute the endpoint

// Custom middleware
app.Use(async (context, next) =>
{
    // Before — runs on the way IN
    var sw = Stopwatch.StartNew();

    await next(context);

    // After — runs on the way OUT
    sw.Stop();
    context.Response.Headers["X-Response-Time"] = $"{sw.ElapsedMilliseconds}ms";
});

// Registration — three lifetimes
builder.Services.AddSingleton<IEmailService, SmtpEmailService>();
// One instance for the entire application lifetime

builder.Services.AddScoped<IOrderRepository, EfOrderRepository>();
// One instance per HTTP request (or DI scope)

builder.Services.AddTransient<IValidator<CreateOrderDto>, CreateOrderValidator>();
// New instance every time it's resolved

// Resolution — constructor injection (preferred)
public class OrderController : ControllerBase
{
    private readonly IOrderRepository _repo;
    private readonly IEmailService _email;

    public OrderController(IOrderRepository repo, IEmailService email)
    {
        _repo = repo;
        _email = email;
    }
}

// BUG: Singleton capturing a Scoped service
builder.Services.AddSingleton<MyService>(); // lives forever
builder.Services.AddScoped<IDbContext, AppDbContext>(); // lives per request

public class MyService
{
    // DbContext captured at first resolution — reused across ALL requests
    // DbContext is not thread-safe — data corruption, connection pool issues
    public MyService(IDbContext db) { ... }
}

// Fix: inject IServiceScopeFactory and create scopes manually
public class MyService
{
    private readonly IServiceScopeFactory _scopeFactory;
    public MyService(IServiceScopeFactory scopeFactory) => _scopeFactory = scopeFactory;

    public async Task DoWorkAsync()
    {
        using var scope = _scopeFactory.CreateScope();
        var db = scope.ServiceProvider.GetRequiredService<IDbContext>();
        // db lives only for this scope
    }
}

public class SmtpSettings
{
    public string Host { get; set; }
    public int Port { get; set; }
}

// Registration
builder.Services.Configure<SmtpSettings>(
    builder.Configuration.GetSection("Smtp"));

// IOptions<T> — Singleton, reads config once at startup
public class EmailService
{
    public EmailService(IOptions<SmtpSettings> options)
    {
        var host = options.Value.Host; // same value forever
    }
}

// IOptionsSnapshot<T> — Scoped, re-reads per request
// Use when config can change at runtime (feature flags, A/B settings)
public class FeatureFlagService
{
    public FeatureFlagService(IOptionsSnapshot<FeatureFlags> opts)
    {
        var flags = opts.Value; // fresh per request
    }
}

// IOptionsMonitor<T> — Singleton with change notification
// Use in background services that need live config updates
public class BackgroundWorker : BackgroundService
{
    private readonly IOptionsMonitor<WorkerSettings> _monitor;

    public BackgroundWorker(IOptionsMonitor<WorkerSettings> monitor)
    {
        _monitor = monitor;
        monitor.OnChange(settings => Log.Information("Settings changed"));
    }

    protected override async Task ExecuteAsync(CancellationToken ct)
    {
        while (!ct.IsCancellationRequested)
        {
            var batchSize = _monitor.CurrentValue.BatchSize; // always current
            await ProcessBatchAsync(batchSize);
        }
    }
}

// Real-world: validate model state once, not in every action
public class ValidateModelFilter : IActionFilter
{
    public void OnActionExecuting(ActionExecutingContext context)
    {
        if (!context.ModelState.IsValid)
        {
            context.Result = new UnprocessableEntityObjectResult(
                context.ModelState);
            // short-circuits — the action method never runs
        }
    }

    public void OnActionExecuted(ActionExecutedContext context) { }
}

// Real-world: audit logging
public class AuditFilter : IAsyncActionFilter
{
    private readonly IAuditService _audit;

    public async Task OnActionExecutionAsync(
        ActionExecutingContext context,
        ActionExecutionDelegate next)
    {
        var before = DateTime.UtcNow;
        var result = await next(); // execute the action

        await _audit.LogAsync(new AuditEntry
        {
            Action = context.ActionDescriptor.DisplayName,
            User = context.HttpContext.User.Identity?.Name,
            Duration = DateTime.UtcNow - before,
            StatusCode = (result.Result as ObjectResult)?.StatusCode,
        });
    }
}

// Register globally or per-controller
builder.Services.AddControllers(options =>
    options.Filters.Add<ValidateModelFilter>());

// Use() pattern — inline, tight coupling, no DI per-request
app.Use(async (context, next) =>
{
    // context and next are all you have
    await next(context);
});

// IMiddleware — DI-friendly, testable, recommended for complex middleware
public class TenantResolutionMiddleware : IMiddleware
{
    private readonly ITenantResolver _resolver; // injected from DI

    public TenantResolutionMiddleware(ITenantResolver resolver)
        => _resolver = resolver;

    public async Task InvokeAsync(HttpContext context, RequestDelegate next)
    {
        var tenantId = _resolver.Resolve(context.Request.Host.Host);
        context.Items["TenantId"] = tenantId;
        await next(context);
    }
}

// Registration
builder.Services.AddTransient<TenantResolutionMiddleware>();
app.UseMiddleware<TenantResolutionMiddleware>();

Writes → Command → CommandHandler → Database (write model)
Reads  → Query  → QueryHandler  → Database/ReadModel (optimised projection)

// COMMAND — changes state, returns acknowledgement
public record PlaceOrderCommand(
    string CustomerId,
    List<OrderItem> Items,
    Address ShippingAddress) : IRequest<Guid>;

// QUERY — reads state, no side effects
public record GetOrderHistoryQuery(
    string CustomerId,
    int Page,
    int PageSize) : IRequest<PagedResult<OrderSummaryDto>>;

// The command handler writes to the normalised relational model
// The query handler can read from a denormalised read model, a cache,
// or even a different database altogether

// Why bother?
// - Scale reads and writes independently (most systems read 10x more than write)
// - Optimise query models for reading (no joins, pre-aggregated)
// - Simpler handlers — each does one thing
// - Clear separation of who changes state vs who observes it

// 1. Define command and handler
public record CreateProductCommand(string Name, decimal Price, int Stock)
    : IRequest<int>;

public class CreateProductHandler : IRequestHandler<CreateProductCommand, int>
{
    private readonly AppDbContext _db;

    public CreateProductHandler(AppDbContext db) => _db = db;

    public async Task<int> Handle(
        CreateProductCommand cmd,
        CancellationToken ct)
    {
        var product = new Product
        {
            Name = cmd.Name,
            Price = cmd.Price,
            Stock = cmd.Stock,
        };
        _db.Products.Add(product);
        await _db.SaveChangesAsync(ct);
        return product.Id;
    }
}

// 2. Define query and handler
public record GetProductQuery(int Id) : IRequest<ProductDto?>;

public class GetProductHandler : IRequestHandler<GetProductQuery, ProductDto?>
{
    private readonly AppDbContext _db;

    public Task<ProductDto?> Handle(GetProductQuery query, CancellationToken ct)
        => _db.Products
            .Where(p => p.Id == query.Id)
            .Select(p => new ProductDto(p.Id, p.Name, p.Price))
            .FirstOrDefaultAsync(ct);
}

// 3. Controller dispatches through MediatR
[ApiController, Route("api/products")]
public class ProductsController : ControllerBase
{
    private readonly IMediator _mediator;
    public ProductsController(IMediator mediator) => _mediator = mediator;

    [HttpPost]
    public async Task<IActionResult> Create(CreateProductCommand cmd)
        => Ok(await _mediator.Send(cmd));

    [HttpGet("{id}")]
    public async Task<IActionResult> Get(int id)
    {
        var result = await _mediator.Send(new GetProductQuery(id));
        return result is null ? NotFound() : Ok(result);
    }
}

// Logging behavior — logs every command/query
public class LoggingBehavior<TRequest, TResponse>
    : IPipelineBehavior<TRequest, TResponse>
    where TRequest : notnull
{
    private readonly ILogger<LoggingBehavior<TRequest, TResponse>> _logger;

    public async Task<TResponse> Handle(
        TRequest request,
        RequestHandlerDelegate<TResponse> next,
        CancellationToken ct)
    {
        var name = typeof(TRequest).Name;
        _logger.LogInformation("Handling {Request}", name);
        var sw = Stopwatch.StartNew();

        var response = await next(); // call the actual handler

        _logger.LogInformation("Handled {Request} in {Ms}ms", name, sw.ElapsedMilliseconds);
        return response;
    }
}

// Validation behavior — validates before handler runs
public class ValidationBehavior<TRequest, TResponse>
    : IPipelineBehavior<TRequest, TResponse>
    where TRequest : notnull
{
    private readonly IEnumerable<IValidator<TRequest>> _validators;

    public async Task<TResponse> Handle(
        TRequest request,
        RequestHandlerDelegate<TResponse> next,
        CancellationToken ct)
    {
        var failures = _validators
            .Select(v => v.Validate(request))
            .SelectMany(r => r.Errors)
            .Where(f => f != null)
            .ToList();

        if (failures.Any())
            throw new ValidationException(failures);

        return await next();
    }
}

// Registration order matters — outer behaviors wrap inner ones
builder.Services.AddTransient(typeof(IPipelineBehavior<,>), typeof(LoggingBehavior<,>));
builder.Services.AddTransient(typeof(IPipelineBehavior<,>), typeof(ValidationBehavior<,>));

// Domain event — immutable record of something that happened
public record OrderPlaced(Guid OrderId, string CustomerId, decimal Total, DateTime OccurredAt);

// Aggregate raises events
public class Order
{
    private readonly List<object> _domainEvents = new();
    public IReadOnlyList<object> DomainEvents => _domainEvents;

    public static Order Place(string customerId, List<OrderItem> items)
    {
        var order = new Order { /* set properties */ };
        order._domainEvents.Add(new OrderPlaced(order.Id, customerId, order.Total, DateTime.UtcNow));
        return order;
    }

    public void ClearDomainEvents() => _domainEvents.Clear();
}

// Publish events after SaveChanges — not before (DB transaction must commit first)
public class AppDbContext : DbContext
{
    private readonly IMediator _mediator;

    public override async Task<int> SaveChangesAsync(CancellationToken ct = default)
    {
        var result = await base.SaveChangesAsync(ct);

        // Collect events from all tracked aggregates
        var events = ChangeTracker.Entries<Order>()
            .SelectMany(e => e.Entity.DomainEvents)
            .ToList();

        foreach (var entity in ChangeTracker.Entries<Order>())
            entity.Entity.ClearDomainEvents();

        // Publish after commit — handlers can read the saved state
        foreach (var domainEvent in events)
            await _mediator.Publish(domainEvent, ct);

        return result;
    }
}

// Handler reacts to the event
public class SendOrderConfirmationEmail : INotificationHandler<OrderPlaced>
{
    public async Task Handle(OrderPlaced notification, CancellationToken ct)
        => await _emailService.SendOrderConfirmationAsync(notification.CustomerId, notification.OrderId);
}

// Problem: if we save the order but the message broker is down, event is lost
await _db.Orders.AddAsync(order);
await _db.SaveChangesAsync(); // ← order saved
await _bus.PublishAsync(new OrderPlaced(order.Id)); // ← might fail!

// Outbox solution: save the event IN THE SAME DB TRANSACTION
public class AppDbContext : DbContext
{
    public DbSet<OutboxMessage> OutboxMessages { get; set; }
}

// In the handler:
await _db.Orders.AddAsync(order);
await _db.OutboxMessages.AddAsync(new OutboxMessage
{
    Id = Guid.NewGuid(),
    Type = nameof(OrderPlaced),
    Payload = JsonSerializer.Serialize(new OrderPlaced(order.Id)),
    CreatedAt = DateTime.UtcNow,
    ProcessedAt = null,
});
await _db.SaveChangesAsync(); // both in one transaction — atomic

// Background job polls outbox and publishes unpublished messages
public class OutboxPublisher : BackgroundService
{
    protected override async Task ExecuteAsync(CancellationToken ct)
    {
        while (!ct.IsCancellationRequested)
        {
            var pending = await _db.OutboxMessages
                .Where(m => m.ProcessedAt == null)
                .OrderBy(m => m.CreatedAt)
                .Take(50)
                .ToListAsync(ct);

            foreach (var msg in pending)
            {
                await _bus.PublishAsync(msg.Type, msg.Payload);
                msg.ProcessedAt = DateTime.UtcNow;
            }

            await _db.SaveChangesAsync(ct);
            await Task.Delay(TimeSpan.FromSeconds(5), ct);
        }
    }
}

// Leak 1: Static collections that grow forever
public static class EventLog
{
    public static List<string> Events = new(); // never cleared
    // Every event added lives for the application lifetime
}

// Leak 2: Event handlers not removed
public class Dashboard
{
    public Dashboard(DataService service)
    {
        service.DataUpdated += OnDataUpdated; // subscribing...
        // DataService holds a reference to Dashboard via the delegate
        // Even if Dashboard is "discarded", GC can't collect it
    }
    // Fix: implement IDisposable and remove the handler
    public void Dispose() => _service.DataUpdated -= OnDataUpdated;
}

// Leak 3: HttpClient created per request
public async Task<string> GetData(string url)
{
    using var client = new HttpClient(); // creates a socket per call
    // Sockets don't close immediately — socket exhaustion under load
    // Fix: inject IHttpClientFactory
}

// Leak 4: Timers not disposed
public class PriceUpdater
{
    private Timer _timer;
    public PriceUpdater() => _timer = new Timer(Update, null, 0, 1000);
    // Timer is registered with the GC finalizer thread — never collected
    // Fix: implement IDisposable, call _timer.Dispose()
}

// Leak 5: Cached DbContext (EF Core change tracker grows forever)
// Fixed by using scoped DbContext, not singleton

// Without pool: allocating temp buffers in a loop = GC pressure
for (int i = 0; i < 10000; i++)
{
    byte[] buffer = new byte[4096]; // 40MB total allocation per loop run
    await stream.ReadAsync(buffer);
    ProcessBuffer(buffer);
    // buffer becomes garbage, GC must collect
}

// With ArrayPool: reuse the same buffer
var pool = ArrayPool<byte>.Shared;
for (int i = 0; i < 10000; i++)
{
    byte[] buffer = pool.Rent(4096); // get from pool (may be larger than 4096)
    try
    {
        await stream.ReadAsync(buffer.AsMemory(0, 4096));
        ProcessBuffer(buffer.AsSpan(0, 4096));
    }
    finally
    {
        pool.Return(buffer); // return to pool — zero GC pressure
    }
}

// Why developers do it (wrong reasoning):
GC.Collect(); // "free up memory after loading large data"
GC.WaitForPendingFinalizers();
GC.Collect();

// Problems:
// 1. Interrupts the GC's optimised generational collection strategy
// 2. Promotes short-lived Gen 0 objects to Gen 1/2 prematurely
// 3. Causes a full Gen 2 collection — the most expensive kind — synchronously
// 4. Pauses the application (stop-the-world)

// When it's acceptable:
// - After a known one-time large allocation (loading a big dataset, then discarding it)
// - In tests that measure allocation
// - In tools/CLIs where pausing doesn't matter
// - After loading large caches before entering a high-throughput phase

// Better approach: understand WHY memory is growing rather than forcing collection
// Use dotnet-counters to watch GC gen0/gen1/gen2 collection rates

# 1. dotnet-counters — live metrics
dotnet-counters monitor --process-id 12345 System.Runtime

# Key counters:
# gc-heap-size: total managed heap
# gen-0/1/2-gc-count: collection frequency
# loh-size: Large Object Heap (objects > 85KB — never compacted by default)
# threadpool-queue-length: async backlog

# 2. dotnet-dump — capture and analyse heap snapshot
dotnet-dump collect --process-id 12345
dotnet-dump analyze ./core_20240101

# In the analyser:
# dumpheap -stat     — show objects by type and size
# dumpheap -type MyClass  — find all instances of a type
# gcroot <address>   — show what's keeping an object alive

# 3. dotnet-trace — CPU and allocation traces
dotnet-trace collect --process-id 12345 --providers Microsoft-DotNETRuntime:0x1:5

# 4. Visual Studio Diagnostic Tools / JetBrains dotMemory for GUI profiling

// Span<T> — stack-only slice, zero allocation, cannot be stored on heap
// Use for synchronous, CPU-bound processing
Span<byte> ParseHeader(byte[] buffer)
{
    // Slice without copying — just a pointer + length
    return buffer.AsSpan(0, 8); // header is first 8 bytes
}

// Memory<T> — heap-compatible slice, can be awaited
// Use when you need to pass a slice to async code
async Task ProcessAsync(Memory<byte> data)
{
    await socket.SendAsync(data); // can cross await boundaries
}

// ArraySegment<T> — legacy; same concept but older API
// Prefer Memory<T> for new code

// Real-world: parsing HTTP headers without allocation
public static bool TryParseContentLength(ReadOnlySpan<char> headerLine, out long contentLength)
{
    var colon = headerLine.IndexOf(':');
    if (colon < 0) { contentLength = 0; return false; }

    var value = headerLine.Slice(colon + 1).Trim();
    return long.TryParse(value, out contentLength);
    // Zero allocation — no string created from the header
}

// VULNERABLE — never do this
string query = $"SELECT * FROM Users WHERE Name = '{userInput}'";
// Input: ' OR '1'='1  → returns all users
// Input: '; DROP TABLE Users; --  → drops the table

// Fix 1: Parameterised queries (ADO.NET)
using var cmd = new SqlCommand("SELECT * FROM Users WHERE Name = @name", conn);
cmd.Parameters.AddWithValue("@name", userInput); // input is data, not code

// Fix 2: EF Core (always parameterised by default)
var users = await _context.Users
    .Where(u => u.Name == userInput) // EF generates parameterised SQL
    .ToListAsync();

// Fix 3: EF Core raw SQL — use interpolation, NOT concatenation
var users = await _context.Users
    .FromSqlInterpolated($"SELECT * FROM Users WHERE Name = {userInput}")
    .ToListAsync();
// EF generates: SELECT * FROM Users WHERE Name = @p0 with @p0 = userInput

// WRONG even with EF:
var users = await _context.Users
    .FromSqlRaw($"SELECT * FROM Users WHERE Name = '{userInput}'") // injection!
    .ToListAsync();

// HTTPS redirection — redirect HTTP to HTTPS
app.UseHttpsRedirection();
// Sends 307 Temporary Redirect from http://example.com to https://example.com

// HSTS (HTTP Strict Transport Security) — tells browsers to ONLY use HTTPS
// After the first HTTPS response, browser refuses to use HTTP for this domain
app.UseHsts();
// Sends: Strict-Transport-Security: max-age=31536000; includeSubDomains

// Configuration
builder.Services.AddHsts(options =>
{
    options.MaxAge = TimeSpan.FromDays(365);
    options.IncludeSubDomains = true;
    options.Preload = true; // submit to browsers' HSTS preload list
});

// Important: never send HSTS on HTTP responses or in development
// Once a browser receives HSTS, it will refuse HTTP even if you remove the header
// Use UseHsts() only in production environments
if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}

// WRONG: plain text
user.Password = password;

// WRONG: MD5/SHA1/SHA256 (fast algorithms — brute-forceable)
user.Password = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(password)));

// CORRECT: ASP.NET Core Identity (use this if possible)
var hasher = new PasswordHasher<User>();
user.PasswordHash = hasher.HashPassword(user, password);
// Uses PBKDF2-HMAC-SHA256 with 100,000+ iterations by default

// CORRECT: BCrypt (alternative, widely used)
user.PasswordHash = BCrypt.Net.BCrypt.HashPassword(password, workFactor: 12);
// workFactor: 12 = 2^12 = 4096 iterations — adjust based on server speed target (~100-300ms)

// Verification
bool valid = BCrypt.Net.BCrypt.Verify(inputPassword, user.PasswordHash);

// Key properties of secure password hashing:
// 1. Slow by design (bcrypt, PBKDF2, Argon2) — makes brute force expensive
// 2. Per-password salt — prevents rainbow table attacks
// 3. One-way — cannot reverse to original password

// gRPC service definition (orders.proto)
// service OrderService {
//   rpc GetOrder (GetOrderRequest) returns (OrderResponse);
//   rpc StreamOrders (StreamRequest) returns (stream OrderEvent);
// }

// gRPC server in .NET
public class OrderGrpcService : OrderService.OrderServiceBase
{
    public override async Task<OrderResponse> GetOrder(
        GetOrderRequest request, ServerCallContext context)
    {
        var order = await _db.Orders.FindAsync(request.OrderId);
        return new OrderResponse { Id = order.Id, Total = (double)order.Total };
    }

    // Server streaming — pushes multiple responses
    public override async Task StreamOrders(
        StreamRequest request,
        IServerStreamWriter<OrderEvent> stream,
        ServerCallContext context)
    {
        await foreach (var evt in _eventSource.GetEventsAsync(context.CancellationToken))
            await stream.WriteAsync(new OrderEvent { OrderId = evt.OrderId });
    }
}

// States: Closed (normal) → Open (failing fast) → Half-Open (testing recovery)

// Using Polly (v8 / Microsoft.Extensions.Resilience)
builder.Services.AddHttpClient<IInventoryService, InventoryService>()
    .AddResilienceHandler("inventory-pipeline", pipeline =>
    {
        pipeline.AddCircuitBreaker(new CircuitBreakerStrategyOptions
        {
            FailureRatio = 0.5,             // 50% failure rate triggers open
            MinimumThroughput = 10,          // at least 10 requests before evaluating
            SamplingDuration = TimeSpan.FromSeconds(30),
            BreakDuration = TimeSpan.FromSeconds(60), // stay open for 60s
            OnOpened = args =>
            {
                Log.Warning("Circuit breaker OPENED for inventory service");
                return ValueTask.CompletedTask;
            },
        });

        pipeline.AddRetry(new RetryStrategyOptions
        {
            MaxRetryAttempts = 3,
            Delay = TimeSpan.FromMilliseconds(200),
            BackoffType = DelayBackoffType.Exponential,
        });
    });

// Order saga: Reserve inventory → Charge payment → Confirm order
// If payment fails → Release inventory (compensating transaction)

public class PlaceOrderSaga
{
    public async Task<bool> ExecuteAsync(PlaceOrderCommand cmd)
    {
        // Step 1
        var reservationId = await _inventory.ReserveAsync(cmd.Items);
        if (reservationId == null) return false;

        try
        {
            // Step 2
            var chargeId = await _payment.ChargeAsync(cmd.CustomerId, cmd.Total);
            if (chargeId == null)
            {
                // Compensate step 1
                await _inventory.ReleaseReservationAsync(reservationId);
                return false;
            }

            try
            {
                // Step 3
                await _orders.ConfirmAsync(cmd.OrderId, reservationId, chargeId);
                return true;
            }
            catch
            {
                // Compensate steps 1 and 2
                await _payment.RefundAsync(chargeId);
                await _inventory.ReleaseReservationAsync(reservationId);
                throw;
            }
        }
        catch
        {
            await _inventory.ReleaseReservationAsync(reservationId);
            throw;
        }
    }
}