ASP.NET Core 11 cheat sheet

Kestrel on .NET 10 only speaks h2c on an endpoint set to HttpProtocols.Http2, and only to clients that use prior knowledge. Http1AndHttp2 without TLS silently falls back to HTTP/1.1, Upgrade: h2c is ignored, and nginx needs proxy_http_version 2 (1.29.4+, stable 1.30) or grpc_pass to talk HTTP/2 upstream. Checked with curl and HttpClient on ASP.NET Core 10.0.10.

Give each singleton a memoized InitializeAsync that awaits its own dependencies, then await them all from IHostedLifecycleService.StartingAsync. Registration order stops mattering, Kestrel does not accept requests until init finishes, and a failure stops the host. Compared against init before app.Run, IHostedService.StartAsync, and a BackgroundService with a readiness check on ASP.NET Core 10.0.10.

Blazor has no nextTick(), but you can build one: a TaskCompletionSource completed in OnAfterRenderAsync. Here is why the @ref is null or stale right after you flip an @if, which common workarounds fail, and a NextRenderAsync helper verified on .NET 10 in both InteractiveServer and InteractiveWebAssembly.

Behind nginx and Docker, ASP.NET Core's ForwardedHeadersMiddleware silently ignores X-Forwarded-For and X-Forwarded-Proto unless the connecting proxy is in KnownIPNetworks or KnownProxies, and ForwardLimit decides how many hops it walks. The four silent-ignore rules, the KnownNetworks to KnownIPNetworks change in .NET 10, and a runnable repro checked on .NET 10.0.10.

ChainedPartitionedRateLimiter walks each limiter once, but the ASP.NET Core rate limiting middleware calls the chain twice when the first pass fails: AttemptAcquire, then AcquireAsync. With fixed window or token bucket limiters a rejected request burns two permits from the first limiter, and a queued request does too. Reproduced on ASP.NET Core 10.0.10 and 11.0 RC3, with a wrapper that makes the middleware walk the chain once.

On October 29, 2026 Microsoft announced Syncfusion as a Blazor contributor. The headline is Syncfusion.Blazor.Toolkit 2.0.1: 17 MIT-licensed components for net8.0, net9.0 and net10.0, free for commercial use with no license key. Here is what is in it, how to wire it up, and where the commercial line is drawn.

Grpc.AspNetCore and Grpc.Net.Client 2.85.0 now apply MaxReceiveMessageSize to the decompressed size of gzip and deflate messages. A 260 KB request that inflates to 256 MiB is rejected with ResourceExhausted, but legitimate large compressed payloads can start failing too.

MudBlazor 9.12.0 fixes a long-standing race in MudAutocomplete, MudDataGrid and MudTable: the result of the search that finished last used to win, not the one started last. Here is how the fix works and what changes for your ServerData and SearchFunc code.

Code resolved a service from a DI scope or root provider after it was disposed. Capture IServiceScopeFactory instead of IServiceProvider and create a fresh scope where the work runs.

The Set-Cookie header is sent, but the browser rejects or never stores it. Fix SameSite=None without Secure, missing credentials: 'include' plus AllowCredentials, consent policy, and late Append calls.

Infragistics open-sourced more than 50 Ignite UI for Blazor controls under MIT, shipped as IgniteUI.Blazor.Lite and IgniteUI.Blazor.GridLite 1.0.0 for net8.0, net9.0 and net10.0. Here is what is free, how to wire it up, and the gotchas.

The October 25, 2026 out-of-band release (.NET 8.0.33, 9.0.22, 10.0.14, 11 RC3) fixes a Brotli buffer overflow, a Linux tarball ownership flaw, and two CVEs the October 13 patches did not fully close.

Add a second UseStaticFiles call with a PhysicalFileProvider and a RequestPath. Why MapStaticAssets can't do it, the absolute-path and content-root traps, dot files and unknown extensions, publishing the folder, and putting it behind authorization. Tested on ASP.NET Core 10.

outputTemplate is fixed per sink, so per-level formatting needs either an ExpressionTemplate with {#if @l ...} blocks or two Logger sub-loggers with ByIncludingOnly / ByExcluding filters. Both configured purely from appsettings.json, tested on Serilog 4.4, Serilog.Settings.Configuration 10.0.1 and Serilog.Expressions 5.0.

Microsoft Agent Framework 1.26.0 makes MapAGUIServer resolve the keyed AIAgent, its AgentSessionStore, and the isolation key provider per request, and adds a selector overload that picks the agent from the HttpContext.

Microsoft.AspNetCore.OpenApi only marks a response nullable when the action returns a bare T? (and, on .NET 10, not even Task<T?>). ActionResult<T?> and IActionResult lose the annotation on both .NET 10 and .NET 11 RC2. Here is why, a tested operation transformer that fixes it, and the 204 No Content trap that makes the spec lie unless you also change MVC's formatter.

MapIdentityApi<TUser>() maps ten endpoints and has no switch to skip one. Here are four measured ways to deal with that on .NET 11: hide an endpoint from OpenAPI, make it return 404, shadow it, or remove it from routing entirely, plus the /confirmEmail trap that turns registration into a 500.

Microsoft.Extensions.Telemetry 10.11.0, released October 15, 2026, adds an experimental IncludeScopes option to global and per-request log buffering, so OrderId and TenantId from BeginScope survive a Flush() instead of being silently dropped.

Upgrading a Blazor Web App whose pages live in a Razor class library or a .Client project from .NET 8 to .NET 10: what stays the same (both AdditionalAssemblies registrations), and the four things that break, from a 404 on blazor.web.js in thin hosts to NotFoundPage pages that render blank. Measured on ASP.NET Core 8.0.32 and 10.0.10.

Use a tenant key prefix on one shared Redis for almost every multi-tenant ASP.NET Core app, move only tenants with contractual isolation or noisy workloads to their own instance, and skip numbered databases: Redis Cluster, Azure Managed Redis and Redis Cloud only have database 0.

Microsoft.AspNetCore.Components.AI is an experimental Blazor package in .NET 11 RC1 that turns any IChatClient into a streaming chat UI with tool approvals, typed tool rendering, and shared state over AG-UI.

With <Nullable>enable</Nullable>, MVC treats every non-nullable reference type as [Required(AllowEmptyStrings = true)]. Mark optional properties as string?, give them a default, or set SuppressImplicitRequiredAttributeForNonNullableReferenceTypes.

On the .NET 10 SDK every Microsoft.NET.Sdk.Web project gets StaticWebAssetBasePath=/, so a web app referencing another web app collides. Set the base path on the referenced project. Disabling compression does not help.

A Blazor Web App page with [Authorize] becomes an endpoint the AuthorizationMiddleware checks, and a failed check calls ChallengeAsync, which needs AddAuthentication. Register a real scheme, or pass component endpoints through to AuthorizeRouteView.

A DelegatingHandler registered before AddStandardResilienceHandler runs once per logical request, not once per retry. Move it after the resilience handler, and make it idempotent, because the retry re-sends the same HttpRequestMessage. Measured on Microsoft.Extensions.Http.Resilience 10.10.0 and 8.10.0.

The binder silently skips array properties without a public setter, get-only IReadOnlyList<T>, fields and init-only members under the source generator, and it appends to defaults instead of replacing them. Measured on .NET 10.0.12 and 11 RC 1.

Call .DisableAntiforgery() on the one endpoint, or on a MapGroup. In ASP.NET Core 11 that opts out of both the token middleware and the new automatic CSRF check. Measured matrix, precedence traps, and narrower alternatives.

A BeginScope middleware misses the exception handler's error log and the Request finished line. Register an ILogEnricher that reads the user from IHttpContextAccessor, open a scope only when work leaves the request, and watch out for Serilog's AddSerilog silently cancelling enrichment.

There is no transaction that spans SQL Server and Blob Storage. Upload to a name the database already knows about, commit second, compensate on failure, and let a sweeper clean up the crash window. With the UploadAsync overload that silently turns a conditional create into an overwrite.

In .NET 10 cookie auth answers API-style endpoints with 401/403 instead of a login redirect. Restore it per endpoint, globally, or with an AppContext switch.

Use ZipFile.CreateFromDirectoryAsync, ExtractToDirectoryAsync, ZipArchive.CreateAsync and ZipArchiveEntry.OpenAsync without hidden synchronous I/O. Measured on .NET 11 RC 1 and .NET 10.0.12, including the .NET 10 bug that still blocks Kestrel.

Put [AsParameters] on a class or record to bind a whole query-string filter in an ASP.NET Core 11 minimal API. Covers defaults, arrays, enums, nested objects, validation, OpenAPI, and a Native AOT generator bug with positional records.

The ASP.NET Core team mapped out where C# 15 union types flow through .NET 11: minimal API and MVC bodies, SignalR's JsonHubProtocol, Blazor, and OpenAPI anyOf schemas. Route, query, header, and form binding are not supported yet.

Microsoft.Authentication.WebAssembly.Msal 10.0.8, 9.0.16 and 8.0.27 moved to msal.js 4, whose async init races itself. Initialize MSAL once in Program.cs, or pin 10.0.7.

The SignalR authentication refresh APIs are finalized in .NET 11 RC 1, with renamed callbacks on HubConnection, a TypeScript client, and Blazor Server circuits that pick up the refreshed ClaimsPrincipal automatically.

A render mode decides where a Razor component executes and whether it is interactive. Here are the four modes in .NET 11, the propagation rules that decide what your component inherits, and the RendererInfo and AssignedRenderMode properties that tell you at runtime which one actually won.

An EF Core interceptor is a class EF calls before and after operations like executing a command or SaveChanges, and it can modify or suppress them, not just observe. Here are the seven interception points in EF Core 11, the registration and lifetime rules, and the cases where a query filter or plain logging is the better answer.

Blazor has no syntax for a variable tag name, and DynamicComponent only renders component types. Override BuildRenderTree and call builder.OpenElement(0, $"h{level}"). Covers attribute splatting, why the tag name must be clamped before it reaches the DOM, why changing the level rips the element out of the DOM even with @key, and an auto-levelling variant built on a cascading value.

A PR merged into dotnet/aspnetcore main on August 19, 2026 makes ExceptionHandlerMiddleware honour BadHttpRequestException.StatusCode instead of overwriting it with 500.

A [FromForm] Dictionary in a minimal API binds with an empty prefix: the form keys must be [key], not metadata[key]. Wrap it in a class to keep readable names.

Swashbuckle 8 and later emit openapi 3.0.4, not 3.0.1, and there is no OpenApiSpecVersion for a patch version. Why it changed, and four ways to pin the string your tooling expects.

ASP.NET Core 11 emits openapi 3.2.0 by default and Swagger UI below 10.1.5 rejects it. Upgrade Swashbuckle.AspNetCore.SwaggerUI, or pin OpenApiVersion back to OpenApi3_1.

Skip the downloadFileFromStream JS module entirely. Render an anchor with the download attribute pointing at a minimal API endpoint that returns TypedResults.File, or POST a plain HTML form with an AntiforgeryToken. Covers why the download attribute is what stops Blazor's enhanced navigation from swallowing the click, why data-enhance silently discards the file, and the cookie-vs-bearer auth trap.

Scalar ships 1.02 MiB of gzipped JavaScript and a far better request builder. Swagger UI ships 514 KiB and renders OpenAPI 3.2, which is what .NET 11 now emits by default. Measured payloads, the 3.2 gap, endpoint routing on both sides, and the auth details that decide it.

Zstandard is the right default for dynamic API responses in .NET 11, but not at the quality the ASP.NET Core provider ships with. Benchmarks on real JSON payloads showing why quality 1 beats the default quality 3 on both size and CPU, when Brotli still wins, and why Gzip survives only as a fallback.

.NET 11 Preview 7 adds an opt-in package that pauses interactive Server circuits when the browser tab is hidden, freeing memory and SignalR connections held by users who are not actually there.

blazor.server.js 404s on .NET 10 because the script stopped being an embedded resource. Add RequiresAspNetWebAssets to the host project, or make sure it has a .razor file.

CS9137 comes from the Microsoft.AspNetCore.OpenApi source generator. Add InterceptorsNamespaces to every project that calls AddOpenApi, not just the one holding the PackageReference.

OpenApiReference was deleted in Microsoft.OpenApi 2.0. Changing the using to Microsoft.OpenApi is not enough: replace each usage with a typed reference such as OpenApiSchemaReference.

Replace UseSwaggerUI with MapScalarApiReference in ASP.NET Core 11: routing, multiple documents, pre-filled auth, production gating, offline assets, and the Scalar-only OpenAPI extensions that mark endpoints stable or hidden.

Choose an ASP.NET Core integration-test setup by what it must prove: HTTP routing, production database behavior, or the published application image.

The reconnect modal means the SignalR circuit dropped, not that your app crashed. Decide whether the retry ended in failed or rejected, then fix sticky sessions, the 3-minute retention window, the 32 KB message limit, or persist circuit state with [PersistentState].

For internal service-to-service calls in .NET 11, default to gRPC when you own both ends of the contract and the call is point-to-point. Use REST with JSON when anything you do not control has to call the service. SignalR is not an RPC transport between services: reach for it only when one producer has to fan a message out to many long-lived consumers.

500.30 means your app threw during startup inside w3wp.exe. The real exception is already in the Windows Application event log under IIS AspNetCore Module V2. Read that first, then rank the fix: missing shared framework, x86/x64 app pool mismatch, missing config, or app pool permissions.

Implement IValidateOptions<T>, register it in DI, and chain ValidateOnStart so a bad appsettings.json kills the process instead of the first request that touches it. Covers the .NET 11 Validate<TValidator>() overload, async validation through IAsyncValidateOptions<T>, and the three places ValidateOnStart silently does nothing.

A complete guide to enabling HTTP/3 on Kestrel in ASP.NET Core 11: the HttpProtocols.Http1AndHttp2AndHttp3 endpoint config, MsQuic platform requirements on Windows, Linux, and macOS, why the first request is never HTTP/3, how to verify with HttpClient and middleware, QuicTransportOptions tuning, and the firewall and proxy gotchas that make it silently fall back.

Default to IOptions<T>. Use IOptionsMonitor<T> when a singleton has to see config reloads, and IOptionsSnapshot<T> only when a scoped consumer wants a value that is stable for one request. The deciding axis is the lifetime of the consumer, not the shape of the settings.

Prerendering runs your component on the server with no browser attached, so IJSRuntime throws. Move the call into OnAfterRenderAsync, gate it on RendererInfo.IsInteractive, or disable prerendering.

Add Aspire 13.4 to a brownfield ASP.NET Core solution by adding two new projects and three lines per service: aspire init, AppHost wiring with AddProject and WithReference, keeping your existing launchSettings.json and connection strings, and the resilience, health-endpoint, and proxy gotchas that bite on day one.

A complete guide to WebApplicationFactory<TEntryPoint> in ASP.NET Core 11: making the Program entry point reachable, ConfigureTestServices vs ConfigureWebHost, replacing the EF Core registration through IDbContextOptionsConfiguration, the new ConfigureHostApplicationBuilder hook in .NET 11 preview 6, faking authentication, WebApplicationFactoryClientOptions, and UseKestrel when you need a real port.

A decision guide for ASP.NET Core 11: middleware runs for every request before your handler binds, endpoint filters run only for the matched endpoint after binding and can see the typed arguments. Includes a feature matrix, when-to-pick-each scenarios, the ordering rules, and the gotchas that force the choice.

Cancelling the CancellationToken you pass to InvokeAsync now reaches the server and cancels the hub method. This closes a SignalR request open since 2019.

In ASP.NET Core 11, return Results<T1, TN> with TypedResults for minimal APIs and ActionResult<T> for controllers. Treat bare IResult and bare IActionResult as escape hatches: they compile for any response but describe nothing to OpenAPI, so you pay for them in hand-written ProducesResponseType attributes.

Use CreateBuilder for a normal app, CreateSlimBuilder when you publish trimmed or Native AOT behind a TLS proxy, and CreateEmptyBuilder only when you want to register every service yourself. Here is the feature matrix and the gotchas that force the call.

Output caching is the right default for almost every server-side app in ASP.NET Core 11. Response caching only wins when your goal is to steer browser and proxy caches through HTTP headers. Here is the decision, with a feature matrix and the gotchas that force the call.

Preview 6 adds AsyncValidationAttribute and IAsyncValidatableObject so DataAnnotations rules can hit the database before your endpoint runs, without blocking a thread.

A complete, working guide to health checks in an ASP.NET Core 11 minimal API: AddHealthChecks and MapHealthChecks, custom IHealthCheck classes returning Healthy/Degraded/Unhealthy, the AddDbContextCheck EF Core probe, tag-based liveness and readiness endpoints for Kubernetes, a JSON ResponseWriter, ResultStatusCodes, securing the endpoint with RequireAuthorization and RequireHost, and pushing results with IHealthCheckPublisher.

A complete, working guide to endpoint filters in an ASP.NET Core 11 minimal API: AddEndpointFilter with an inline delegate, IEndpointFilter classes with DI, GetArgument and the Arguments list, short-circuiting with Results.Problem, FIFO/FILO ordering across multiple filters, group-level filters on MapGroup, and AddEndpointFilterFactory for signature-aware filters.

Preview 6 rejects unsafe cross-origin browser requests by default, reading the Sec-Fetch-Site header instead of an antiforgery token. Here is what it blocks and how to opt out.

Kestrel caps request bodies at 30,000,000 bytes by default and returns 413 when you exceed it. Raise MaxRequestBodySize globally, per endpoint, or in web.config behind IIS.

You set a header, status code, or content type after the body was already flushed. Set all headers before the first write, or guard with HttpResponse.HasStarted and OnStarting.

A complete guide to response compression in ASP.NET Core 11: AddResponseCompression and UseResponseCompression, the new built-in Zstandard provider alongside Brotli and Gzip, compression levels, EnableForHttps and the CRIME/BREACH risk, custom MIME types, middleware ordering, and when to let the reverse proxy do it instead.

Declare the handler's return type as Results<Ok<T>, NotFound> and return TypedResults.Ok / TypedResults.NotFound: the union gives compile-time checking that the handler only returns what it declares, and it self-describes to OpenAPI so you never write .Produces by hand. Covers async handlers, the six-type limit, and testing in ASP.NET Core 11.

A complete, working guide to output caching in an ASP.NET Core 11 minimal API: AddOutputCache and UseOutputCache, CacheOutput on endpoints and MapGroup, named and base policies, Expire, VaryByQuery and VaryByHeader, tag-based eviction with EvictByTagAsync, cache stampede protection, ETag revalidation, and a Redis backing store.

A deep dive into the built-in OpenAPI transformer pipeline in .NET 11: operation vs schema transformers, the context objects, execution order, DI-activated transformers, and recipes for headers, responses, examples, and per-property tweaks.

IHostedService is the two-method interface (StartAsync/StopAsync) the .NET generic host calls on startup and graceful shutdown. Here is exactly what the contract promises, when to implement it directly, and the .NET 10 and 11 behavior changes that catch people out.

A step-by-step migration guide for replacing hand-rolled if-checks in ASP.NET Core 11 minimal API handlers with the built-in source-generated DataAnnotations validator: what breaks, which manual rules do and do not port, and how to verify the 400 ProblemDetails contract stays identical.

A minimal API returns 415 when the request Content-Type does not match what the endpoint binds. Send Content-Type: application/json for a body-bound type, or use [FromForm] for form and file uploads.

Call AddProblemDetails with a CustomizeProblemDetails callback to reshape the 400 that built-in minimal API validation returns in ASP.NET Core 11: add a traceId, rewrite the title, switch 400 to 422, or take full control with a custom IProblemDetailsWriter.

A complete, working setup for JWT bearer authentication in an ASP.NET Core 11 minimal API: install the package, wire up AddAuthentication().AddJwtBearer(), issue a token, protect endpoints with RequireAuthorization, add role and claim policies, and test the whole thing with dotnet user-jwts.

Use cookie authentication for any app where the browser is the only client, and reserve JWT bearer tokens for APIs called by mobile apps, other services, or third parties. Here is the full decision matrix.

A protected endpoint returning 405 instead of 401 almost always means routing rejected the HTTP verb before auth ran, or a cookie scheme stole the challenge. Here is how to tell which.

A valid token that still 401s almost always means the bearer handler never ran or ran under the wrong scheme. Check middleware order, the default scheme, the scheme name, and whether the header even reached the handler.

Register more than one implementation of the same interface under a key with AddKeyedSingleton/Scoped/Transient, then resolve them with [FromKeyedServices], GetRequiredKeyedService, or KeyedService.AnyKey. The keyed and non-keyed registries are separate, which is the gotcha that bites most people.

A complete guide to TokenValidationParameters in ASP.NET Core 11: how ValidateIssuer, ValidateAudience, and ValidateLifetime work, what the defaults actually are, why Authority auto-configures the issuer and signing keys, the 5-minute ClockSkew trap, and how to read the IDX error codes when a valid-looking token is rejected.

A complete guide to CORS for a bearer-token API in ASP.NET Core 11: the correct UseCors ordering relative to authentication, why a bearer token in the Authorization header is not a CORS credential, why AllowAnyHeader works but a manual wildcard does not cover Authorization, and how to keep preflight from failing.

Reading session state in static server-rendered Blazor meant reaching into HttpContext.Session and serializing by hand. .NET 11 Preview 5 adds [SupplyParameterFromSession] so a component property binds to a session key directly.

Compare ASP.NET Core built-in Minimal API validation with FluentValidation: asynchronous rules, endpoint filters, version differences and licensing.

Default to HybridCache for new caching code in .NET 11. Reach for IMemoryCache only when you need raw single-server speed with no serialization, and IDistributedCache only as a backing store. Here is the decision matrix.

The error means Data Protection lost the key that signed the token. Persist keys to a shared, durable store and call SetApplicationName so every instance reads the same key ring.

Static server-rendered Blazor forms could only validate after a full POST round-trip. .NET 11 Preview 5 renders validation metadata so the Blazor JS enforces DataAnnotations rules in the browser, no circuit required.

You put @rendermode on a child whose parent is already interactive. A subtree has exactly one render mode. Remove the child directive or move it to the boundary.

A prerendered Blazor component runs its initialization twice and loses state at the interactive handoff. Fix it with the [PersistentState] attribute or the PersistentComponentState service in .NET 11.

Swashbuckle is gone from the ASP.NET Core templates. Here is how to generate and serve an OpenAPI document in .NET 11 with the built-in Microsoft.AspNetCore.OpenApi package: AddOpenApi, MapOpenApi, transformers, multiple documents, build-time generation, and a UI on top.

Organize Minimal APIs into resource extension methods with MapGroup. Understand nested routes, shared metadata, filters, authentication and testing.

Wire HybridCache to a Redis L2 in ASP.NET Core 11: register the service, add the StackExchange Redis distributed cache, and let GetOrCreateAsync give you a two-tier cache with built-in stampede protection and tag invalidation.

ASP.NET Core 11 has built-in validation for minimal APIs: call AddValidation, annotate your request record with DataAnnotations, and a source generator validates the bound model and returns 400 ProblemDetails before your handler runs. No controllers, no FluentValidation, no manual checks.

A step-by-step checklist to move a standalone Blazor Server app to the unified Blazor Web App template on .NET 11, keeping every page on InteractiveServer with zero behaviour change.

Pick BackgroundService for in-process loops, raw IHostedService when you need fine lifecycle control, and Hangfire when jobs must survive a restart. A decision matrix with code and the one gotcha that picks for you.

Calling Task.Run from a controller loses work on shutdown, swallows exceptions, and captures disposed scoped services. The safe pattern is a bounded Channel queue drained by a BackgroundService that opens a fresh scope per work item and drains in-flight work on StopAsync.

A BackgroundService is a singleton, so it cannot inject a scoped service like a DbContext directly. Take IServiceScopeFactory, open one scope per unit of work with CreateAsyncScope, resolve inside it, and dispose it when the work is done.

Plan a .NET Framework 4.8 migration with accurate support status, incremental ASP.NET boundaries, dependency checks, configuration, and rollback.

Choose Blazor Web App render modes or standalone WebAssembly using hosting, offline, service, and support requirements, with corrected Auto behavior.

.NET 11 Preview 4 makes ASP.NET Core OpenAPI generation recognize HTTP QUERY as a first-class operation in OpenAPI 3.2, with a graceful fallback for 3.0 and 3.1 documents.

Pick minimal APIs by default in ASP.NET Core 11. Use controllers only when you need MVC features that minimal APIs still do not match: convention-based routing across many actions, MVC-style filters, or Razor views.

Replace the Stream.Read or Write call with ReadAsync/WriteAsync. As a last resort, set AllowSynchronousIO on Kestrel, IIS, or per-request via IHttpBodyControlFeature.

ASP.NET Core's scope validation throws this when a singleton would capture a scoped dependency for the rest of the process. Make the consumer scoped, or take IServiceScopeFactory and create a scope on demand.

ASP.NET Core throws this when a constructor asks for a type that was never registered, was registered on the wrong container, or was added after the host was built. Three concrete fixes cover almost every case.

If GetConnectionString returns null in .NET 11, your appsettings.json is missing the key, not copied to the build output, or the wrong environment file is being selected. Three checks fix 95% of cases.

A complete guide to wiring Serilog 4.x and Seq 2025.2 into a .NET 11 ASP.NET Core app: AddSerilog vs UseSerilog, two-stage bootstrap logging, JSON configuration, enrichers, request logging, OpenTelemetry trace correlation, API keys, and the production gotchas around buffering, retention, and signal level.

Wire OpenTelemetry traces, metrics, and logs into a .NET 11 ASP.NET Core app with the OTLP exporter, then ship them to a free, self-hosted backend: the standalone Aspire Dashboard for local dev, Jaeger and SigNoz for self-hosted production, and the OpenTelemetry Collector when you need both.

A complete guide to per-endpoint rate limiting in ASP.NET Core 11: when to pick fixed window vs sliding window vs token bucket vs concurrency, how RequireRateLimiting and [EnableRateLimiting] differ, partitioning by user or IP, the OnRejected handler, and the distributed deployment pitfall everyone hits.

Stream Claude responses from an ASP.NET Core 11 minimal API end-to-end: the official Anthropic .NET SDK, TypedResults.ServerSentEvents, SseItem, IAsyncEnumerable, cancellation flow, and the gotchas that buffer your tokens silently. With Claude Sonnet 4.6 and Opus 4.7 examples.

Asp.Versioning 10.0 is the first release that targets .NET 10 and the new Microsoft.AspNetCore.OpenApi pipeline. Sander ten Brinke's April 23 walkthrough shows how to register one OpenAPI document per API version with WithDocumentPerVersion().

In .NET 11 the OpenAPI document is generated by Microsoft.AspNetCore.OpenApi and Swagger UI is no longer in the template. Here is how to wire Bearer, OAuth2 with PKCE, and OpenID Connect so the Authorize button actually works.

Two working paths in .NET 11: the built-in MapIdentityApi /refresh endpoint, and a custom JWT setup with refresh token rotation, family tracking, and reuse detection.

Upload multi-GB files to Azure Blob Storage from .NET 11 without loading them into memory. BlockBlobClient.UploadAsync with StorageTransferOptions, MultipartReader for ASP.NET Core uploads, and the buffering traps that put your payload on the LOH.

Configure a Minimal API for Native AOT with generated JSON metadata. Understand builder choices, deployment toolchains, warnings and feature limitations.

A complete guide to global exception handling in ASP.NET Core 11: why IExceptionFilter is the wrong tool, how IExceptionHandler and UseExceptionHandler work together, ProblemDetails responses, multi-handler chains, and the .NET 10 diagnostics suppression breaking change.

Use Kiota, Microsoft's official OpenAPI code generator, to produce a fluent, strongly typed C# client from any OpenAPI spec. Step-by-step: install, generate, wire into ASP.NET Core DI, and handle authentication.

Serve large files from ASP.NET Core 11 without loading them into memory. Three tiers: PhysicalFileResult for on-disk files, Results.Stream for arbitrary streams, and Response.BodyWriter for generated payloads -- with code for each.

A HMAC validation flaw in Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6 lets attackers forge ciphertexts. .NET 10.0.7 is the mandatory fix.

.NET 11 Preview 3 lets Kestrel serve HTTP/3 requests before the peer's control stream and SETTINGS frame arrive, shaving handshake latency off the first request on every new QUIC connection.

ASP.NET Core in .NET 11 Preview 3 teaches the Virtualize component to measure items at runtime, fixing the spacing and scroll jitter that uniform-height assumptions caused.

ASP.NET Core in .NET 11 Preview 2 brings TempData to Blazor static server-side rendering, enabling flash messages and Post-Redirect-Get flows without workarounds.

ASP.NET Core in .NET 11 Preview 2 adds OpenTelemetry semantic attributes directly to HTTP server activity, removing the need for OpenTelemetry.Instrumentation.AspNetCore.

Kestrel's HTTP/1.1 request parser in .NET 11 replaces BadHttpRequestException with a result struct, cutting malformed-request overhead by up to 40%.

A new project template in .NET 11 Preview 2 scaffolds the JS plumbing, WebWorkerClient, and JSExport boilerplate needed to run .NET code in a browser Web Worker.

If your Bearer token works in Postman but not in Scalar, the problem is likely your OpenAPI document. Here is how to declare a proper security scheme in .NET 10.

Fix the 'dotnet-ef does not exist' / 'dotnet ef command not found' error by installing the EF Core CLI as a global or local .NET tool.

Fix the 'Microsoft.NetCore.App or Microsoft.AspNetCore.App was not found' error by updating your Azure App Service stack and .NET runtime version.