| 1 | What does the WithMethods() CORS policy builder method control, and why restrict it instead of using AllowAnyMethod()? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Beginner |
| 2 | How would you set up a CORS policy that allows any subdomain of a given domain (like *.mycompany.com) using SetIsOriginAllowed? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 3 | What is CORS, and why do browsers enforce it? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Beginner |
| 4 | How do you configure a CORS policy in ASP.NET Core to allow requests from specific origins? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 5 | What does AllowCredentials() do in a CORS policy, and why can't it be combined with a wildcard origin? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 6 | Why must UseCors be positioned after UseRouting but before UseAuthorization in the ASP.NET Core middleware pipeline? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 7 | How do you configure CORS to allow requests only from multiple specific origins, such as both a production and staging frontend? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 8 | What is the difference between CORS and CSRF (Cross-Site Request Forgery), and how does CORS relate to (but not fully prevent) CSRF? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 9 | How do you troubleshoot a CORS error reported in browser developer tools, and what does the error message typically indicate? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 10 | What is a CORS preflight request, and when does the browser send one automatically? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 11 | How do you apply different CORS policies to different endpoints or controllers within the same application? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 12 | What security risks does an overly permissive CORS policy (like AllowAnyOrigin with credentials attempted, or reflecting the Origin header) introduce? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 13 | How does CORS interact with a reverse proxy or API gateway sitting in front of multiple backend microservices? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 14 | How do you configure CORS to expose custom response headers to client-side JavaScript using Access-Control-Expose-Headers? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 15 | How does CORS behave differently for requests made from a mobile app or server-to-server call compared to a browser-based web app? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 16 | How does the WithMethods() CORS policy builder method restrict cross-origin requests, and why is it preferable to AllowAnyMethod() for sensitive endpoints? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 17 | What is CORS, and why does an ASP.NET Core API need to explicitly configure it for browser-based clients on a different origin? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Beginner |
| 18 | Where must UseCors be positioned in the middleware pipeline relative to UseRouting and UseAuthorization, and why does this order matter? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 19 | Why can't AllowCredentials() be combined with a wildcard origin (AllowAnyOrigin), and what does this mean for cookie-authenticated cross-origin APIs? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 20 | How do you configure CORS to expose custom response headers (like X-Total-Count for pagination) to client-side JavaScript? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 21 | What is the difference between CORS and CSRF protection, and why doesn't a strict CORS policy alone fully protect a cookie-authenticated endpoint? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 22 | How would you troubleshoot a CORS error in browser developer tools, and what's the most common root cause? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 23 | What is a CORS preflight request, and when does the browser automatically send one before the actual request? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 24 | How do you apply different CORS policies to different controllers or minimal API endpoint groups within the same application? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 25 | How would you configure CORS to allow any subdomain of a known domain (like *.mycompany.com) using SetIsOriginAllowed with custom matching logic? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 26 | How does CORS interact with an API gateway or reverse proxy sitting in front of multiple backend microservices? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 27 | How does CORS behave for requests made from a mobile app, server-to-server call, or a tool like curl/Postman, compared to a browser-based web app? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 28 | How do you configure CORS to allow multiple specific known origins simultaneously, such as production, staging, and local development? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 29 | How would you write an integration test verifying that a CORS policy correctly allows a specific origin and rejects an unauthorized one? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 30 | What security risk does dynamically reflecting the Origin header back as Access-Control-Allow-Origin introduce, and why is it a dangerous anti-pattern? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 31 | What is CORS middleware in Express, and how does the cors package simplify configuring Cross-Origin Resource Sharing? Node.js › Express & Middleware | Node.js | Express & Middleware | Intermediate |
| 32 | How do you configure CORS correctly when a Blazor WebAssembly app is hosted on a different origin than its backend API? ASP.NET Core › Blazor Integration with ASP.NET Core | ASP.NET Core | Blazor Integration with ASP.NET Core | Intermediate |
| 33 | How does JWT (JSON Web Token) authentication work at a high level in ASP.NET Core? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 34 | How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 35 | What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 36 | How does cookie-based authentication work in ASP.NET Core, and when is it preferred over token-based authentication? ASP.NET Core › Authentication | ASP.NET Core | Authentication | Intermediate |
| 37 | How do you call an existing ASP.NET Core minimal API or controller endpoint from a Blazor WebAssembly component using HttpClient? ASP.NET Core › Blazor Integration with ASP.NET Core | ASP.NET Core | Blazor Integration with ASP.NET Core | Intermediate |
| 38 | Why can't browsers natively call gRPC services directly, and what is gRPC-Web, and how does it solve this? ASP.NET Core › gRPC Services | ASP.NET Core | gRPC Services | Intermediate |
| 39 | How does ASP.NET Core determine the original client IP address and scheme (HTTP/HTTPS) when running behind a reverse proxy that terminates TLS and forwards requests, given the app only sees the proxy's connection? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Intermediate |
| 40 | What is the recommended standard order for common middleware in a typical ASP.NET Core Web API pipeline, and why? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Advanced |
| 41 | How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |