ASP.NET CORE Web API - Final Recap & Mega Quiz

1. Recap Table: 14 API Concepts That Crash Production

2. The 6 Production Killers - Zomato Code Examples

A. Captive Dependency - Restaurant Data Leak

// STARTUP - THE BUG
builder.Services.AddSingleton<IRestaurantCache, RestaurantCache>();
builder.Services.AddScoped<IZomatoDbContext, ZomatoDbContext>();

public class RestaurantCache : IRestaurantCache {
    private readonly IZomatoDbContext _db; // Captures first request's DbContext
    public RestaurantCache(IZomatoDbContext db) => _db = db;
    public async Task<List<Restaurant>> GetForUserAsync(int userId) {
        // Request #1: User 123. _db cached.
        // Request #2: User 456 calls this. _db still has User 123 data in ChangeTracker
        return await _db.Restaurants.Where(r => r.CityId == GetUserCity(userId)).ToListAsync(); // Returns wrong city
    }
}
// FIX: Inject IServiceScopeFactory, create scope per method call

B. Overposting - Free Zomato Order

// ENTITY
public class Order { public int Id {get;set;} public decimal Total {get;set;} public bool IsPaid {get;set;} }

// BAD API - Binds to Entity
[HttpPost] public IActionResult Create(Order order) { // Hacker posts {total:0.01, isPaid:true}
    _db.Orders.Add(order); _db.SaveChanges(); // BOOM - $0.01 order marked paid
}

// GOOD - Input DTO = Whitelist
public class OrderCreateDto { public List<CartItemDto> Items {get;set;} }
[HttpPost] public IActionResult Create(OrderCreateDto dto) {
    var order = new Order {
        Total = CalculateTotal(dto.Items), // Server calculates
        IsPaid = false // Server controls
    };
    _db.Orders.Add(order); _db.SaveChanges();
}

C. JWT ValidateAudience=false - Account Takeover

// BAD CONFIG
services.AddAuthentication("Bearer").AddJwtBearer(o => {
    o.TokenValidationParameters = new TokenValidationParameters {
        ValidateIssuer = true,
        ValidateAudience = false, // BUG
        IssuerSigningKey = key
    };
});
// Attack: Get JWT from dev.zomato.com. Audience=dev. Replay to api.zomato.com.
// Server accepts because audience not checked. Hacker = you.
// FIX: ValidateAudience = true, ValidAudience = "api.zomato.com"

D. CORS AllowAnyOrigin + AllowCredentials - Cookie Theft

// BAD
builder.Services.AddCors(o => o.AddPolicy("AllowAll", p => {
    p.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().AllowCredentials();
}));
// Browser blocks this: Cannot use wildcard origin with credentials.
// But if you use.SetIsOriginAllowed(_ => true), it passes.
// Hacker site evil.com makes fetch('https://api.zomato.com/user', {credentials:'include'})
// Browser sends Zomato cookies to hacker. Session hijack.
// FIX:.WithOrigins("https://www.zomato.com", "https://m.zomato.com").AllowCredentials()

E. Exception Middleware Order - Yellow Screen in Prod

// BAD ORDER
app.UseRouting();
app.UseAuthorization();
app.UseEndpoints(e => e.MapControllers());
app.UseExceptionHandler("/error"); // TOO LATE
// Exception thrown in UseRouting or Auth = not caught. Unhandled exception = 500 YSOD
// FIX: app.UseExceptionHandler("/error"); MUST be first after app.UseDeveloperExceptionPage

F. No CancellationToken - DB Meltdown

// BAD
[HttpGet("restaurants")] public async Task<IActionResult> Search([FromQuery] string q) {
    return Ok(await _db.Restaurants.Where(r => r.Name.Contains(q)).ToListAsync()); // No CT
}
// User searches, closes app. Request cancelled. But EF query still runs 30s.
// 10k users do this = 10k DB connections stuck. Pool exhausted. All requests 503.
// FIX: ToListAsync(cancellationToken). Pass CancellationToken ct to action.

Mega Quiz 🧠 - 30 Questions. Zomato API Edition.