Dotnet Api Csharp

Implementation Rules

• Prefer async all the way; avoid sync-over-async.
• Use DI with proper lifetimes (Singleton, Scoped, Transient).
• Keep controllers/endpoints thin; move logic to application services.
• Use CancellationToken on I/O-bound operations.
• Use structured logging with correlation/trace context.
• Never expose secrets; use environment/config providers.
• Avoid broad catch (Exception) unless converting to known API error contract.
• Keep API contracts stable and versioned when introducing breaking changes.

Data and EF Core Guidance

• Use explicit projections for read paths; avoid over-fetching.
• Use AsNoTracking() for read-only queries.
• Keep migrations small and reviewable.
• Prefer idempotent, transactional write flows.
• Prevent N+1 query patterns and unbounded result sets.

Security and Reliability

• Validate all inbound DTOs.
• Enforce authorization policies close to endpoints.
• Use rate limiting and input-size safeguards for public endpoints when applicable.
• Return safe error payloads; don’t leak internals.

Testing Expectations

• Unit-test business logic and edge cases.
• Integration-test endpoint contracts and auth behavior.
• Cover failure paths (validation, not found, conflict, forbidden).

References

• Backend checklist
• API error contract