Return Retry-After when a client should back off
Tell API clients when another attempt may succeed instead of leaving them to guess a retry delay.
Aspnet-Core
Treat CORS as a browser boundary, not API authorization
Use CORS to control browser-script access across origins, while enforcing API permissions with authentication and authorization.
Set request body limits intentionally
Choose global and endpoint-specific request body limits instead of inheriting accidental defaults for uploads and APIs.
Treat uploaded files as untrusted
Keep uploads quarantined until required metadata, content, and resource checks succeed, while treating client filenames as untrusted.
Use streaming for large or frequent uploads
Use MultipartReader when buffered ASP.NET Core uploads put too much pressure on memory, temporary-disk capacity, or disk I/O.
Keep public API DTOs separate from domain entities
Use explicit request and response contracts so persistence fields and domain state do not become part of the public API accidentally.
Choose rate-limiting policies by endpoint cost
Apply different ASP.NET Core rate limits to cheap reads and expensive AI or data-processing endpoints.
When an AI Request Should Become a Background Job
How to decide when a .NET AI request should stay synchronous, stream its response, or move to a durable background job with HTTP 202 and a status resource.
Cache GET responses only when user context is clear
Do not cache a GET response unless the cache key matches the user, tenant, and permission boundary that shaped it.
Middleware order is important
Place ASP.NET Core middleware in the order that matches routing, security, and endpoint behavior.