ASP.NET Core 11 cheat sheet

IHostedService is the two-method interface (StartAsync/StopAsync) the .NET generic host calls on startup and graceful shutdown. Here is exactly what the contract promises, when to implement it directly, and the .NET 10 and 11 behavior changes that catch people out.

A step-by-step migration guide for replacing hand-rolled if-checks in ASP.NET Core 11 minimal API handlers with the built-in source-generated DataAnnotations validator: what breaks, which manual rules do and do not port, and how to verify the 400 ProblemDetails contract stays identical.

A minimal API returns 415 when the request Content-Type does not match what the endpoint binds. Send Content-Type: application/json for a body-bound type, or use [FromForm] for form and file uploads.

Call AddProblemDetails with a CustomizeProblemDetails callback to reshape the 400 that built-in minimal API validation returns in ASP.NET Core 11: add a traceId, rewrite the title, switch 400 to 422, or take full control with a custom IProblemDetailsWriter.

A complete, working setup for JWT bearer authentication in an ASP.NET Core 11 minimal API: install the package, wire up AddAuthentication().AddJwtBearer(), issue a token, protect endpoints with RequireAuthorization, add role and claim policies, and test the whole thing with dotnet user-jwts.

Use cookie authentication for any app where the browser is the only client, and reserve JWT bearer tokens for APIs called by mobile apps, other services, or third parties. Here is the full decision matrix.

A protected endpoint returning 405 instead of 401 almost always means routing rejected the HTTP verb before auth ran, or a cookie scheme stole the challenge. Here is how to tell which.

A valid token that still 401s almost always means the bearer handler never ran or ran under the wrong scheme. Check middleware order, the default scheme, the scheme name, and whether the header even reached the handler.

Register more than one implementation of the same interface under a key with AddKeyedSingleton/Scoped/Transient, then resolve them with [FromKeyedServices], GetRequiredKeyedService, or KeyedService.AnyKey. The keyed and non-keyed registries are separate, which is the gotcha that bites most people.

A complete guide to TokenValidationParameters in ASP.NET Core 11: how ValidateIssuer, ValidateAudience, and ValidateLifetime work, what the defaults actually are, why Authority auto-configures the issuer and signing keys, the 5-minute ClockSkew trap, and how to read the IDX error codes when a valid-looking token is rejected.

A complete guide to CORS for a bearer-token API in ASP.NET Core 11: the correct UseCors ordering relative to authentication, why a bearer token in the Authorization header is not a CORS credential, why AllowAnyHeader works but a manual wildcard does not cover Authorization, and how to keep preflight from failing.

Reading session state in static server-rendered Blazor meant reaching into HttpContext.Session and serializing by hand. .NET 11 Preview 5 adds [SupplyParameterFromSession] so a component property binds to a session key directly.

Use the built-in source-generated validation for synchronous, attribute-expressible rules in ASP.NET Core 11; reach for FluentValidation when you need async rules, complex cross-field logic, or validation kept out of your domain models.

Default to HybridCache for new caching code in .NET 11. Reach for IMemoryCache only when you need raw single-server speed with no serialization, and IDistributedCache only as a backing store. Here is the decision matrix.

The error means Data Protection lost the key that signed the token. Persist keys to a shared, durable store and call SetApplicationName so every instance reads the same key ring.

Static server-rendered Blazor forms could only validate after a full POST round-trip. .NET 11 Preview 5 renders validation metadata so the Blazor JS enforces DataAnnotations rules in the browser, no circuit required.

You put @rendermode on a child whose parent is already interactive. A subtree has exactly one render mode. Remove the child directive or move it to the boundary.

A prerendered Blazor component runs its initialization twice and loses state at the interactive handoff. Fix it with the [PersistentState] attribute or the PersistentComponentState service in .NET 11.

Swashbuckle is gone from the ASP.NET Core templates. Here is how to generate and serve an OpenAPI document in .NET 11 with the built-in Microsoft.AspNetCore.OpenApi package: AddOpenApi, MapOpenApi, transformers, multiple documents, build-time generation, and a UI on top.

A complete guide to structuring minimal APIs in ASP.NET Core 11 with MapGroup: per-resource endpoint modules as extension methods, nested groups, shared filters and auth, route-parameter prefixes, OpenAPI tags, and the filter-ordering rules that surprise people.

Wire HybridCache to a Redis L2 in ASP.NET Core 11: register the service, add the StackExchange Redis distributed cache, and let GetOrCreateAsync give you a two-tier cache with built-in stampede protection and tag invalidation.

ASP.NET Core 11 has built-in validation for minimal APIs: call AddValidation, annotate your request record with DataAnnotations, and a source generator validates the bound model and returns 400 ProblemDetails before your handler runs. No controllers, no FluentValidation, no manual checks.

A step-by-step checklist to move a standalone Blazor Server app to the unified Blazor Web App template on .NET 11, keeping every page on InteractiveServer with zero behaviour change.

Pick BackgroundService for in-process loops, raw IHostedService when you need fine lifecycle control, and Hangfire when jobs must survive a restart. A decision matrix with code and the one gotcha that picks for you.

Calling Task.Run from a controller loses work on shutdown, swallows exceptions, and captures disposed scoped services. The safe pattern is a bounded Channel queue drained by a BackgroundService that opens a fresh scope per work item and drains in-flight work on StopAsync.

A BackgroundService is a singleton, so it cannot inject a scoped service like a DbContext directly. Take IServiceScopeFactory, open one scope per unit of work with CreateAsyncScope, resolve inside it, and dispose it when the work is done.

A version-pinned migration playbook for moving a .NET Framework 4.8 codebase to .NET 11 LTS in 2026, covering the SDK-style csproj rewrite, System.Web to ASP.NET Core, WCF, EF6 to EF Core 11, BinaryFormatter removal, AppDomain replacements, and a realistic rollback plan.

For any new Blazor app on .NET 11, scaffold a Blazor Web App (the template formerly nicknamed Blazor United) and pick render modes per page. Server-only and WebAssembly-only templates only still make sense in narrow cases.

.NET 11 Preview 4 makes ASP.NET Core OpenAPI generation recognize HTTP QUERY as a first-class operation in OpenAPI 3.2, with a graceful fallback for 3.0 and 3.1 documents.

Pick minimal APIs by default in ASP.NET Core 11. Use controllers only when you need MVC features that minimal APIs still do not match: convention-based routing across many actions, MVC-style filters, or Razor views.

Replace the Stream.Read or Write call with ReadAsync/WriteAsync. As a last resort, set AllowSynchronousIO on Kestrel, IIS, or per-request via IHttpBodyControlFeature.

ASP.NET Core's scope validation throws this when a singleton would capture a scoped dependency for the rest of the process. Make the consumer scoped, or take IServiceScopeFactory and create a scope on demand.

ASP.NET Core throws this when a constructor asks for a type that was never registered, was registered on the wrong container, or was added after the host was built. Three concrete fixes cover almost every case.

If GetConnectionString returns null in .NET 11, your appsettings.json is missing the key, not copied to the build output, or the wrong environment file is being selected. Three checks fix 95% of cases.

A complete guide to wiring Serilog 4.x and Seq 2025.2 into a .NET 11 ASP.NET Core app: AddSerilog vs UseSerilog, two-stage bootstrap logging, JSON configuration, enrichers, request logging, OpenTelemetry trace correlation, API keys, and the production gotchas around buffering, retention, and signal level.

Wire OpenTelemetry traces, metrics, and logs into a .NET 11 ASP.NET Core app with the OTLP exporter, then ship them to a free, self-hosted backend: the standalone Aspire Dashboard for local dev, Jaeger and SigNoz for self-hosted production, and the OpenTelemetry Collector when you need both.

A complete guide to per-endpoint rate limiting in ASP.NET Core 11: when to pick fixed window vs sliding window vs token bucket vs concurrency, how RequireRateLimiting and [EnableRateLimiting] differ, partitioning by user or IP, the OnRejected handler, and the distributed deployment pitfall everyone hits.

Stream Claude responses from an ASP.NET Core 11 minimal API end-to-end: the official Anthropic .NET SDK, TypedResults.ServerSentEvents, SseItem, IAsyncEnumerable, cancellation flow, and the gotchas that buffer your tokens silently. With Claude Sonnet 4.6 and Opus 4.7 examples.

Asp.Versioning 10.0 is the first release that targets .NET 10 and the new Microsoft.AspNetCore.OpenApi pipeline. Sander ten Brinke's April 23 walkthrough shows how to register one OpenAPI document per API version with WithDocumentPerVersion().

In .NET 11 the OpenAPI document is generated by Microsoft.AspNetCore.OpenApi and Swagger UI is no longer in the template. Here is how to wire Bearer, OAuth2 with PKCE, and OpenID Connect so the Authorize button actually works.

Two working paths in .NET 11: the built-in MapIdentityApi /refresh endpoint, and a custom JWT setup with refresh token rotation, family tracking, and reuse detection.

Upload multi-GB files to Azure Blob Storage from .NET 11 without loading them into memory. BlockBlobClient.UploadAsync with StorageTransferOptions, MultipartReader for ASP.NET Core uploads, and the buffering traps that put your payload on the LOH.

A complete .NET 11 walkthrough for shipping an ASP.NET Core minimal API with Native AOT: PublishAot, CreateSlimBuilder, source-generated JSON, the AddControllers limitation, IL2026 / IL3050 warnings, and EnableRequestDelegateGenerator for library projects.

A complete guide to global exception handling in ASP.NET Core 11: why IExceptionFilter is the wrong tool, how IExceptionHandler and UseExceptionHandler work together, ProblemDetails responses, multi-handler chains, and the .NET 10 diagnostics suppression breaking change.

Use Kiota, Microsoft's official OpenAPI code generator, to produce a fluent, strongly typed C# client from any OpenAPI spec. Step-by-step: install, generate, wire into ASP.NET Core DI, and handle authentication.

Serve large files from ASP.NET Core 11 without loading them into memory. Three tiers: PhysicalFileResult for on-disk files, Results.Stream for arbitrary streams, and Response.BodyWriter for generated payloads -- with code for each.

A HMAC validation flaw in Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6 lets attackers forge ciphertexts. .NET 10.0.7 is the mandatory fix.

.NET 11 Preview 3 lets Kestrel serve HTTP/3 requests before the peer's control stream and SETTINGS frame arrive, shaving handshake latency off the first request on every new QUIC connection.

ASP.NET Core in .NET 11 Preview 3 teaches the Virtualize component to measure items at runtime, fixing the spacing and scroll jitter that uniform-height assumptions caused.

ASP.NET Core in .NET 11 Preview 2 brings TempData to Blazor static server-side rendering, enabling flash messages and Post-Redirect-Get flows without workarounds.

ASP.NET Core in .NET 11 Preview 2 adds OpenTelemetry semantic attributes directly to HTTP server activity, removing the need for OpenTelemetry.Instrumentation.AspNetCore.

Kestrel's HTTP/1.1 request parser in .NET 11 replaces BadHttpRequestException with a result struct, cutting malformed-request overhead by up to 40%.

A new project template in .NET 11 Preview 2 scaffolds the JS plumbing, WebWorkerClient, and JSExport boilerplate needed to run .NET code in a browser Web Worker.

If your Bearer token works in Postman but not in Scalar, the problem is likely your OpenAPI document. Here is how to declare a proper security scheme in .NET 10.

Fix the 'dotnet-ef does not exist' / 'dotnet ef command not found' error by installing the EF Core CLI as a global or local .NET tool.

Fix the 'Microsoft.NetCore.App or Microsoft.AspNetCore.App was not found' error by updating your Azure App Service stack and .NET runtime version.