| 1 | What is CORS, and why does an ASP.NET Core API need to explicitly configure it for browser-based clients on a different origin? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Beginner |
| 2 | Where must UseCors be positioned in the middleware pipeline relative to UseRouting and UseAuthorization, and why does this order matter? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 3 | How do you configure CORS to expose custom response headers (like X-Total-Count for pagination) to client-side JavaScript? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 4 | What is the difference between CORS and CSRF protection, and why doesn't a strict CORS policy alone fully protect a cookie-authenticated endpoint? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 5 | How would you troubleshoot a CORS error in browser developer tools, and what's the most common root cause? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 6 | How does the WithMethods() CORS policy builder method restrict cross-origin requests, and why is it preferable to AllowAnyMethod() for sensitive endpoints? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 7 | What is a CORS preflight request, and when does the browser automatically send one before the actual request? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 8 | How do you apply different CORS policies to different controllers or minimal API endpoint groups within the same application? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 9 | How would you configure CORS to allow any subdomain of a known domain (like *.mycompany.com) using SetIsOriginAllowed with custom matching logic? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 10 | How does CORS interact with an API gateway or reverse proxy sitting in front of multiple backend microservices? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 11 | How does CORS behave for requests made from a mobile app, server-to-server call, or a tool like curl/Postman, compared to a browser-based web app? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 12 | How do you configure CORS to allow multiple specific known origins simultaneously, such as production, staging, and local development? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 13 | How would you write an integration test verifying that a CORS policy correctly allows a specific origin and rejects an unauthorized one? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Advanced |
| 14 | Why can't AllowCredentials() be combined with a wildcard origin (AllowAnyOrigin), and what does this mean for cookie-authenticated cross-origin APIs? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 15 | What security risk does dynamically reflecting the Origin header back as Access-Control-Allow-Origin introduce, and why is it a dangerous anti-pattern? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 16 | How do you configure CORS correctly when a Blazor WebAssembly app is hosted on a different origin than its backend API? ASP.NET Core › Blazor Integration with ASP.NET Core | ASP.NET Core | Blazor Integration with ASP.NET Core | Intermediate |
| 17 | How does cookie-based authentication work in ASP.NET Core, and when is it preferred over token-based authentication? ASP.NET Core › Authentication | ASP.NET Core | Authentication | Intermediate |
| 18 | How do you call an existing ASP.NET Core minimal API or controller endpoint from a Blazor WebAssembly component using HttpClient? ASP.NET Core › Blazor Integration with ASP.NET Core | ASP.NET Core | Blazor Integration with ASP.NET Core | Intermediate |
| 19 | Why can't browsers natively call gRPC services directly, and what is gRPC-Web, and how does it solve this? ASP.NET Core › gRPC Services | ASP.NET Core | gRPC Services | Intermediate |
| 20 | How does ASP.NET Core determine the original client IP address and scheme (HTTP/HTTPS) when running behind a reverse proxy that terminates TLS and forwards requests, given the app only sees the proxy's connection? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Intermediate |