ASP.NET Core Tutorials: APIs, Security and Deployment

Last updated: October 21, 2026

Every ASP.NET Core article on this site, grouped by the job you are doing: building an API, keeping it running, securing it, structuring it and shipping it. Posts marked tested on .NET 10 were rewritten from a working project; their code, HTTP responses and error messages are real output. If you arrived with an error message, start with the table below.

Hit one of these? Start here

You see this	Read this
Angular or React app: 404 on refresh or deep link after deployment, Unexpected token '<' from an API call, or “Expected a JavaScript-or-Wasm module script”	SPA fallback for ASP.NET Core, nginx and IIS
Angular guard: NG0203: The `Router` token injection failed, or navigation hangs with no error	Angular AuthGuard: inject() rules and async guards
An error occurred when configuring the exception handler middleware at startup	IExceptionHandler: startup errors
Handled exceptions stopped appearing in logs after upgrading to .NET 10, or a 404 handler returns 500	IExceptionHandler gotchas
Blazor WebAssembly: TypeError: Failed to fetch and “blocked by CORS policy” in the console	Blazor WebAssembly: call an API (CORS)
PlatformNotSupportedException: Cannot wait on monitors on this runtime in Blazor WebAssembly	Blazor WebAssembly: .Result and .Wait()
AmbiguousMatchException (HTTP 500) after replacing Microsoft.AspNetCore.Mvc.Versioning with Asp.Versioning.Mvc	API versioning with Asp.Versioning
An HTTP/1.x request was sent to an HTTP/2 only endpoint, or gRPC HTTP_1_1_REQUIRED	gRPC in .NET 10
Failed to determine the https port for redirect, or ERR_TOO_MANY_REDIRECTS behind Nginx, an ingress or a load balancer	Enforce HTTPS in ASP.NET Core
The rate limiter returns 503 instead of 429, or one client’s requests block everybody	Rate limiting on .NET 10
A health check ignores its timeout, or Degraded still returns HTTP 200	Health checks: setup and gotchas
A MediatR notification handler throws after SaveChanges and the request fails anyway	CQRS with MediatR
TaskCanceledException: The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing	HttpClient timeouts and retries
Background job lost on restart, or not sure if you need Hangfire	Hangfire vs Quartz.NET vs BackgroundService

1. Build the API

Start with one of the first two. Controllers and minimal APIs end up in the same place; pick the style your team already reads.

• Build a REST API with ASP.NET Core: controller-based CRUD API with EF Core, step by step, plus the usual Web API pitfalls.
• Minimal APIs: CRUD endpoints, DI, route groups, validation, OpenAPI, and when controllers are still the better fit.
• Entity Framework Core 9: setup, migrations, one-to-many and many-to-many relationships, and the performance tips that matter.
• CRUD Web API on .NET 6: the older employee CRUD walkthrough (GET, POST, PUT, DELETE with a DbContext).
• Send email with MailKit: SMTP email from .NET, HTML mail, Gmail and Office 365 settings.

2. Shape and evolve the API

• API versioning: URL, header and query versioning with Asp.Versioning, sunset and deprecation headers, one OpenAPI document per version, and the migration from the old package. (rewritten and tested on .NET 10)
• gRPC: all four call types, interceptors, deadlines, retries, the 4 MB limit, and a measured gRPC vs REST comparison. (rewritten and tested on .NET 10)
• SignalR: live chat and server push with strongly typed hubs, JWT on hubs, and scaling with Redis or Azure SignalR.
• Output caching: output vs response caching, vary-by rules, tag invalidation and a Redis store for several servers.
• Rate limiting: fixed window, sliding window, token bucket and concurrency measured side by side, per-client policies and a proper 429. (rewritten and tested on .NET 10)

3. Keep it running

• Global error handling with IExceptionHandler: Problem Details with a trace ID, handler order, empty 500s for browsers, and the .NET 10 change that stops logging handled exceptions. (tested on .NET 10)
• HttpClient, timeouts and retries: socket exhaustion measured, IHttpClientFactory, the 100-second Timeout exception and the standard resilience handler. (tested on .NET 10)
• Health checks: SQL Server and EF Core checks, liveness vs readiness, Kubernetes probes, and three behaviours that surprise people. (rewritten and tested on .NET 10)
• Serilog structured logging: setup, sinks, enrichment and correlation, and Serilog vs NLog vs the built-in logger.
• OpenTelemetry: traces, custom spans and metrics, and log correlation across services and queues.
• Background jobs: BackgroundService, Hangfire and Quartz.NET running in one app, with what each one survives. (rewritten and tested on .NET 10)

4. Secure it

Read the first one if the words still blur together; the rest assume you know which is which.

• Authentication vs authorization: the security pipeline, issuing a JWT, roles vs policies, and a custom authorization handler.
• JWT authentication: bearer tokens on login and protecting endpoints with [Authorize].
• Enforce HTTPS and HSTS: 307 vs 308, the missing HTTPS port, why HSTS is never sent to localhost, redirect loops behind a proxy (KnownIPNetworks), 400 for APIs, certificates and secure cookies. (rewritten and tested on .NET 10)
• Prevent XSS: what Razor encodes for you and the five layers that cover the rest.
• API security: the OWASP API Top 10 in ASP.NET Core: object-level authorization, input validation, rate limits, secrets.
• ASP.NET Core security checklist: HTTPS, CSRF, security headers, over-posting, secrets and dependency updates in one list.
• OWASP Top 10 for .NET: each of the ten risks with the .NET fix.

5. Structure it

• CQRS with MediatR: commands, queries, validation and logging behaviours, notifications and the measured cost of the mediator. (rewritten and tested on .NET 10)
• Vertical slice architecture: organising by feature with MediatR and minimal APIs, compared with layers.
• Clean architecture: domain, application, infrastructure and API layers, and clean vs onion vs hexagonal.
• .NET microservices: a three-service demo with a YARP gateway, retries and a circuit breaker measured, and the outbox pattern. (rewritten and tested on .NET 10)
• 12-factor apps: config, backing services, disposability and logs, applied to ASP.NET Core.

6. Ship it

• Dockerize an ASP.NET Core app: a multi-stage Dockerfile, container publishing without a Dockerfile, and Compose for local development.
• Angular AuthGuard with functional route guards: protect Angular routes in front of an ASP.NET Core API with CanActivateFn, returnUrl redirects, role guards and canMatch, and why the API must still check the token. (tested on Angular 22)
• Angular 404 on page refresh after deployment: serving an Angular build from ASP.NET Core with MapFallbackToFile, plus nginx, IIS and Apache fallbacks, the MIME-type error and subfolder base href. (tested on .NET 10, Angular 22, nginx 1.30)
• Deploy to Azure App Service: Azure CLI, Visual Studio and GitHub Actions deployment, and pricing tiers.
• Deploy to AKS: container registry, Kubernetes manifests, zero-downtime rollouts and autoscaling.
• GitHub Actions CI/CD: build, test, NuGet caching, coverage and deploying to Azure with OIDC.
• Azure DevOps Pipelines: azure-pipelines.yml, artifacts and automatic deployment to App Service.

7. Web UI in C# with Blazor

• Blazor WebAssembly tutorial for .NET 10: a task app with localStorage, calling an API across origins (CORS), the measured 2.25 MB download and why .Result throws. (tested on .NET 10)
• Blazor Server vs WebAssembly vs United: how each render mode works and which to choose.

Related guides

The language features these posts rely on (records, primary constructors, pattern matching, async/await, dependency injection) are collected in the C# tutorials guide.