ASP.NET CORE Web API - Deep Dive

1. The 13-Layer Request Pipeline - Zomato Order Flow

2. DI Lifetime Deep Dive - The 3 Containers

// ROOT CONTAINER - Created at startup. Lives forever. Holds Singletons
var rootProvider = builder.Services.BuildServiceProvider();

// SCOPE CONTAINER - Created per HTTP request. Holds Scoped services
using var scope = rootProvider.CreateScope();
var scopedProvider = scope.ServiceProvider; // DbContext lives here

// TRANSIENT - New instance every GetService call
var transient = scopedProvider.GetRequiredService<ITransientService>();

Captive Dependency - The #1 DI Bug

// BUG - Singleton captures Scoped
builder.Services.AddSingleton<IOrderProcessor, OrderProcessor>();
builder.Services.AddScoped<AppDbContext, AppDbContext>();

public class OrderProcessor {
  private readonly AppDbContext _db; // Captures FIRST request's DbContext
  public OrderProcessor(AppDbContext db) => _db = db; // DI resolves from Root scope
}
// Request #1: Root creates scope, creates DbContext, injects, disposes scope.
// _db now disposed. Request #2: _db.Users.ToListAsync() = ObjectDisposedException

// FIX - Inject IServiceScopeFactory
public OrderProcessor(IServiceScopeFactory scopeFactory) {
  _scopeFactory = scopeFactory;
}
public async Task Process() {
  using var scope = _scopeFactory.CreateScope(); // New scope per call
  var db = scope.ServiceProvider.GetRequiredService<AppDbContext>(); // Fresh DbContext
} // scope.Dispose() → db.Dispose()

3. Async/Await Internals - Why async void Kills Prod

The State Machine

public async Task<IActionResult> Get() {
  var data = await _db.GetAsync(); // Compiler rewrites to state machine
  return Ok(data);
}

// Compiler generates:
class <Get>d__1 : IAsyncStateMachine {
  public int <>1__state;
  public AsyncTaskMethodBuilder<IActionResult> <>t__builder;
  public TaskAwaiter<Data> <>u__1;

  void MoveNext() {
    if (<>1__state == 0) {
      try {
        var result = <>u__1.GetResult(); // Throws if faulted
        <>t__builder.SetResult(Ok(result)); // Completes Task
      } catch (Exception ex) {
        <>t__builder.SetException(ex); // Stores exception in Task
      }
    }
  }
}

Key Point: AsyncTaskMethodBuilder.SetException(ex) stores exception in Task.Exception. MVC awaits Task, catches exception, returns 500.

Why async void Crashes

public async void Bad() {
  await Task.Delay(100);
  throw new Exception("boom");
}
// Compiler uses AsyncVoidMethodBuilder
// On exception: AsyncVoidMethodBuilder.SetException(ex)
// → Posts to SynchronizationContext.Current
// ASP.NET Core: SynchronizationContext.Current == null
// → Exception unobserved on thread pool
// → Environment.FailFast() → Process kill

Rule: async Task for libraries/APIs. async void ONLY for event handlers in UI with SyncCtx. Never in ASP.NET Core.

4. EF Core Performance - The 5 Killers

5. Authentication Deep Dive - JWT Validation Pipeline

// 1. JwtBearerHandler.HandleAuthenticateAsync()
var token = GetTokenFromHeader(); // Authorization: Bearer ey...
var validationParams = Options.TokenValidationParameters;

// 2. TokenHandler.ValidateToken()
var principal = handler.ValidateToken(token, validationParams, out var validToken);

// 3. Validation steps - ALL must pass
ValidateSignature(validToken, validationParams.IssuerSigningKey); // HMAC SHA256
ValidateIssuer(validToken.Issuer, validationParams.ValidIssuer); // "https://auth.zomato.com"
ValidateAudience(validToken.Audience, validationParams.ValidAudience); // "https://api.zomato.com"
ValidateLifetime(validToken.ValidFrom, validToken.ValidTo, validationParams.ClockSkew); // exp, nbf
ValidateIssuerSigningKey(); // Key not revoked

// 4. If all pass: HttpContext.User = ClaimsPrincipal
// If any fail: 401 Unauthorized + WWW-Authenticate: Bearer error="invalid_token"

Staff Tip: Set ClockSkew = TimeSpan.Zero in prod. Default 5min allows replay attack window. Only use 5min if servers not NTP synced.

6. Minimal APIs - Filter Pipeline

app.MapGet("/restaurants/{id}", async (int id, AppDbContext db) => {
  return await db.Restaurants.FindAsync(id);
})
.AddEndpointFilter<ValidationFilter>() // Runs before handler
.AddEndpointFilter<LoggingFilter>(); // Runs after ValidationFilter

class ValidationFilter : IEndpointFilter {
  public async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext ctx, EndpointFilterDelegate next) {
    if (ctx.Arguments[0] is int id && id < 0)
      return Results.BadRequest("ID negative"); // Short-circuit
    return await next(ctx); // Call next filter or handler
  }
}

vs Controllers: No IAsyncActionFilter. Use IEndpointFilter. No ModelStateInvalidFilter. Must manually validate. Faster startup, less reflection.