ASP.NET MVC interview questions and answers

Razor Class Libraries package shared views and static assets.

Precompiled views and predictable locations avoid probing.

Only local URLs or an allowlist of domains.

Branch pipelines or check Accept headers in the exception handler.

Move use cases to application services and keep actions as HTTP adapters.

Use a dedicated EditInput model with only allowed fields.

Cache expensive anonymous fragments and load personal bits separately.

Read the token from a cookie or hidden field and send RequestVerificationToken header.

Add OAuth handlers for Google or Microsoft, store logins in AspNetUserLogins, and link accounts carefully.

I enumerate public routes or content ids and build absolute URLs with LinkGenerator.

Configure session/TempData to Redis for multi-server farms.

Render a view to string with a test host and compare to approved files.

An action filter records Stopwatch around next().

AllowedHosts configuration rejects unknown hosts.

Ship RCL NuGet versions and pin apps.

Enable RazorCompileOnPublish so views become assemblies.

Generate a nonce per request, put it in CSP header and on script tags.

A custom IAuthorizationFilter or middleware checks AJAX and returns 401 JSON instead of login HTML.

On successful login with old algorithm, rehash with Identity hasher and store.

Separate Area with its own layout, auth policies, and menus.