DEV Community: Leandro Veiga

Future Trends and the Role of .NET 9 in the Evolution of Software Development

Leandro Veiga — Tue, 29 Apr 2025 18:00:00 +0000

In this article, we’ll analyze how the innovations introduced in .NET 9 align with emerging software development trends, show practical code examples, discuss real-world use cases and best practices, and peek at what’s next in future .NET releases.

Introduction
Key Innovations in .NET 9
Emerging Software Development Trends
Alignment of .NET 9 with Future Trends
Practical Code Examples
- URL-Safe Encoding with Base64Url
- Rate Limiting with the Built-In API
Use Cases & Adoption Scenarios
Best Practices
Looking Ahead: What to Expect in .NET 10+
Conclusion

Introduction

The .NET ecosystem continues to evolve at a brisk pace. With each major release, Microsoft introduces features to improve performance, developer productivity, and cross-platform consistency. .NET 9 arrives at a time when cloud-native architectures, AI/ML integration, edge computing, and low-code trends are reshaping how we build software. Let’s see how .NET 9 helps you stay ahead of the curve.

Key Innovations in .NET 9

.NET 9 brings a range of enhancements across the runtime, libraries, and SDK:

Base64Url Class: A first-party, zero-allocation API for URL-safe Base64 encoding and decoding.
Rate Limiting Middleware: New abstractions for defining fixed-window, sliding-window, and token-bucket policies.
AOT & NativeAOT Improvements: Faster startup, reduced memory footprint, and expanded platform support.
Source Generator Enhancements: More powerful code-generation scenarios for JSON, logging, and DI.
PeriodicTimer: Built-in timer abstraction for clean, efficient scheduling without Task.Delay loops.

Emerging Software Development Trends

As we look ahead, several trends are influencing architecture and tooling choices:

Cloud-Native & Microservices: Containerized workloads, serverless functions, and distributed tracing.
AI/ML Integration: Embedding cognitive services, on-device inference, and pipeline orchestration.
Edge & IoT: Lightweight runtimes, offline modes, and low-latency processing.
Observability & Reliability: Built-in metrics, logs, and tracing for proactive incident response.
Developer Productivity: Source generators, faster builds, IDE enhancements, and low-code platforms.

Alignment of .NET 9 with Future Trends

.NET 9 addresses these trends through:

Performance & AOT: NativeAOT’s faster startup suits edge/IoT and serverless.
Built-In Middleware: Rate limiting and Base64Url reduce reliance on third-party libraries.
Scheduling Primitives: PeriodicTimer simplifies background tasks in microservices.
Enhanced Source Generators: Automate serialization and logging for observability.
Cross-Platform Consistency: Uniform behavior on Windows, Linux, macOS, and mobile.

Practical Code Examples

URL-Safe Encoding with Base64Url

using System;
using System.Text;

class Program
{
    static void Main()
    {
        string payload = "user=42;exp=1700000000";
        byte[] data = Encoding.UTF8.GetBytes(payload);

        // Encode to URL-safe Base64
        string token = Base64Url.Encode(data);
        Console.WriteLine($"Encoded Token: {token}");

        // Decode back
        byte[] decoded = Base64Url.Decode(token);
        Console.WriteLine($"Decoded: {Encoding.UTF8.GetString(decoded)}");
    }
}

This zero-allocation API replaces +, / with -, _, and handles padding automatically—ideal for JWTs, query strings, and presigned URLs.

Rate Limiting with the Built-In API

using Microsoft.AspNetCore.RateLimiting;
using System.Threading.RateLimiting;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddRateLimiter(options =>
{
    options.AddTokenBucketLimiter("ApiPolicy", ctx => new TokenBucketRateLimiterOptions
    {
        TokenLimit = 100,
        TokensPerPeriod = 20,
        ReplenishmentPeriod = TimeSpan.FromSeconds(1),
        QueueLimit = 10,
        AutoReplenishment = true
    });
});

var app = builder.Build();
app.UseRateLimiter();

app.MapGet("/data", () => "Hello, World!")
   .RequireRateLimiting("ApiPolicy");

app.Run();

This built-in middleware gives you fine-grained control without external dependencies.

Use Cases & Adoption Scenarios

API Gateways & Edge Proxies: Enforce rate limiting and URL-safe tokens.
Microservices: Schedule periodic jobs with PeriodicTimer, handle load shedding.
IoT & Edge: Use NativeAOT builds for small footprints and fast cold starts.
Secure Token Services: Issue and validate URL-safe tokens natively.
Observability Pipelines: Source-generated serializers for logs and metrics.

Best Practices

Embrace Zero-Allocation APIs: Use Base64Url and RateLimiter for critical paths.
Prefer NativeAOT: For edge devices and serverless, compile ahead-of-time.
Use Source Generators: Automate JSON, logging, and DI boilerplate.
Monitor & Trace: Integrate OpenTelemetry and Application Insights.
Secure by Design: Always validate tokens, handle exceptions, enforce HTTPS.
CI/CD & A/B Testing: Automate AOT builds and feature rollouts.

Looking Ahead: What to Expect in .NET 10+

While .NET 9 focuses on performance and core libraries, future releases may bring:

Enhanced ML.NET Integration: Built-in model serving in ASP.NET.
Low-Code + API Composition: Drag-and-drop workflows generating C# code.
Deeper AI Tooling: First-class support for LLMs and vector search.
Expanded Platform Coverage: WebAssembly AOT for Blazor and edge runtimes.
Unified Telemetry: Automatic tracing and correlation across services.

Conclusion

.NET 9 is a strategic step toward a future where software is faster, more secure, and seamlessly integrated with cloud, edge, and AI ecosystems. By adopting its new features—Base64Url, Rate Limiting, AOT improvements, and enhanced source generators—you’ll be ready for the next wave of software development.

What future .NET feature are you most excited about? Share your thoughts in the comments!

Happy coding!

Efficient Background Jobs & Scheduled Tasks in .NET 8 with Hosted Services

Leandro Veiga — Sat, 26 Apr 2025 15:08:25 +0000

In this post, we'll dive into how to run background jobs and schedule recurring tasks in .NET 8 using built-in Hosted Services. You’ll see:

How to implement IHostedService and BackgroundService
Strategies for scheduling (Timers, Cron)
Real-world use cases (email sending, data cleanup, queue processing)
Best practices for reliability, graceful shutdown, and observability

Let’s get started!

Introduction
Understanding Hosted Services
Creating a Simple BackgroundService
Scheduling Recurring Tasks
Handling One-Off Background Jobs
Use Cases & Examples
Best Practices
Conclusion

Introduction

Background jobs and scheduled tasks are essential for:

Processing messages or workqueues
Periodic cleanup (logs, cache)
Sending emails or notifications
Data aggregation or reporting

.NET 8’s Hosted Services (IHostedService/BackgroundService) provide a clean, DI-friendly way to run these tasks alongside your Web or API application.

Understanding Hosted Services

A Hosted Service is a class that runs in the background of your application. There are two main approaches:

Implement IHostedService
- Two methods: StartAsync(CancellationToken) and StopAsync(CancellationToken).
Derive from BackgroundService
- Override ExecuteAsync(CancellationToken) for a long-running loop.

Both integrate with the Generic Host (WebApplication in minimal APIs or HostBuilder), support DI, configuration, and graceful shutdown.

Creating a Simple BackgroundService

Here's a minimal example of a service that logs a message every 10 seconds:

using System;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;

public class TimedLoggerService : BackgroundService
{
    private readonly ILogger<TimedLoggerService> _logger;
    private readonly TimeSpan _interval = TimeSpan.FromSeconds(10);

    public TimedLoggerService(ILogger<TimedLoggerService> logger)
    {
        _logger = logger;
    }

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        _logger.LogInformation("TimedLoggerService started.");

        while (!stoppingToken.IsCancellationRequested)
        {
            _logger.LogInformation("TimedLoggerService heartbeat at: {time}", DateTimeOffset.Now);
            await Task.Delay(_interval, stoppingToken);
        }

        _logger.LogInformation("TimedLoggerService stopping.");
    }
}

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddHostedService<TimedLoggerService>();
var app = builder.Build();
app.Run();

Scheduling Recurring Tasks

Using PeriodicTimer

In .NET 8 you can use PeriodicTimer:

protected override async Task ExecuteAsync(CancellationToken stoppingToken)
{
    using var timer = new PeriodicTimer(TimeSpan.FromMinutes(1));
    while (await timer.WaitForNextTickAsync(stoppingToken))
    {
        // Your scheduled work here
    }
}

Cron-Style Scheduling

For cron expressions, use a library like Cronos:

using Cronos;

public class CronJobService : BackgroundService
{
    private readonly CronExpression _expression = CronExpression.Parse("0 */5 * * * *"); // every 5 minutes
    private DateTimeOffset _nextRun = DateTimeOffset.MinValue;

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        while (!stoppingToken.IsCancellationRequested)
        {
            var now = DateTimeOffset.Now;
            if (now >= _nextRun)
            {
                // Do work
                _nextRun = _expression.GetNextOccurrence(now) ?? DateTimeOffset.MaxValue;
            }
            await Task.Delay(TimeSpan.FromSeconds(30), stoppingToken);
        }
    }
}

Handling One-Off Background Jobs

To enqueue fire-and-forget jobs (e.g., send an email after a request), use a Channel<T>:

public interface IBackgroundJobQueue
{
    ValueTask QueueJobAsync(Func<CancellationToken, Task> job);
    ValueTask<Func<CancellationToken, Task>> DequeueAsync(CancellationToken cancellationToken);
}

public class BackgroundJobQueue : IBackgroundJobQueue
{
    private readonly Channel<Func<CancellationToken, Task>> _queue =
        Channel.CreateUnbounded<Func<CancellationToken, Task>>();

    public async ValueTask QueueJobAsync(Func<CancellationToken, Task> job) =>
        await _queue.Writer.WriteAsync(job);

    public async ValueTask<Func<CancellationToken, Task>> DequeueAsync(CancellationToken token) =>
        await _queue.Reader.ReadAsync(token);
}

public class QueuedHostedService : BackgroundService
{
    private readonly IBackgroundJobQueue _jobQueue;
    private readonly ILogger<QueuedHostedService> _logger;

    public QueuedHostedService(IBackgroundJobQueue jobQueue, ILogger<QueuedHostedService> logger)
    {
        _jobQueue = jobQueue;
        _logger = logger;
    }

    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        while (!stoppingToken.IsCancellationRequested)
        {
            var job = await _jobQueue.DequeueAsync(stoppingToken);
            try { await job(stoppingToken); }
            catch (Exception ex) { _logger.LogError(ex, "Error executing job"); }
        }
    }
}

builder.Services.AddSingleton<IBackgroundJobQueue, BackgroundJobQueue>();
builder.Services.AddHostedService<QueuedHostedService>();

Use Cases & Examples

Email & Notification Sending: Offload slow SMTP calls.
Data Cleanup: Remove stale records or temp files on a schedule.
Message Processing: Consume a queue or topic (RabbitMQ, Azure Service Bus).
Report Generation: Build and store reports during off-peak hours.

Best Practices

Graceful Shutdown: Honor the CancellationToken and clean up resources.
Exception Handling: Catch exceptions inside loops to avoid crashing the service.
Logging & Metrics: Instrument your service with logs and counters (e.g., Prometheus).
Dependency Injection: Inject only scoped or singleton services appropriately.
Backoff & Retry: Implement retry policies with exponential backoff for transient failures.
Health Checks: Expose health endpoints to monitor background service status.

Conclusion

Hosted Services in .NET 8 provide a powerful and flexible way to run background jobs and scheduled tasks. By following these examples and best practices, you can build reliable, maintainable, and observable background processing in your applications.

Feel free to share your own experiences or questions in the comments below!

Happy coding!

Mastering URL‑Safe Encoding with .NET 9’s Base64Url Class: Examples & Best Practices

Leandro Veiga — Wed, 23 Apr 2025 00:28:10 +0000

With .NET 9 Microsoft has introduced a dedicated Base64Url class to streamline URL‑safe Base64 encoding and decoding. In this post, you’ll learn:

Why URL‑safe Base64 matters
How to use the new Base64Url API in .NET 9
Real‑world use cases (tokens, query strings, data embedding)
Best practices to avoid common pitfalls

Let’s dive in!

Introduction
Why URL‑Safe Base64?
The .NET 9 Base64Url Class
Code Examples
- Encoding & Decoding Strings
- Working with Binary Data
- Integrating with ASP.NET Core
Common Use Cases
Best Practices
Conclusion

Introduction

Base64 is a popular encoding mechanism for binary-to-text transformations. However, standard Base64 uses characters like +, /, and = which can break URLs or require extra escaping. URL‑safe Base64 replaces these with -, _, and omits padding, making it ideal for tokens, query parameters, and other web contexts.

.NET 9’s new Base64Url class provides:

Simple, zero‑allocation methods
Consistent behavior across platforms
Built‑in handling of padding and illegal characters

Why URL‑Safe Base64?

Standard Base64:

Uses + and / in its alphabet
Adds = padding at the end
Requires URL‑encoding when used in query strings
Can introduce parsing errors or double‑encoding

URL‑safe Base64:

Substitutes + → - and / → _
Omits or gracefully handles padding
Safe to embed in URLs without extra encoding

The .NET 9 Base64Url Class

The new class lives in the System namespace:

namespace System
{
    public static class Base64Url
    {
        public static string Encode(byte[] data);
        public static byte[] Decode(string urlSafeBase64);
    }
}

Key points:

Encode(byte[]) produces a URL‑safe string (no +, /, or trailing =).
Decode(string) accepts padded or unpadded URL‑safe Base64 strings.

Code Examples

Encoding & Decoding Strings

using System;
using System.Text;

class Program
{
    static void Main()
    {
        string original = "Hello, .NET 9!";
        byte[] bytes = Encoding.UTF8.GetBytes(original);

        // Encode to URL-safe Base64
        string encoded = Base64Url.Encode(bytes);
        Console.WriteLine($"Encoded: {encoded}");
        // e.g. "SGVsbG8sIC5ORGVDOSA"

        // Decode back to bytes
        byte[] decodedBytes = Base64Url.Decode(encoded);
        string decoded = Encoding.UTF8.GetString(decodedBytes);

        Console.WriteLine($"Decoded: {decoded}");
        // "Hello, .NET 9!"
    }
}

Working with Binary Data

using System;
using System.Security.Cryptography;

class BinaryExample
{
    static void Main()
    {
        // Generate a random 32-byte key
        byte[] key = RandomNumberGenerator.GetBytes(32);

        // URL-safe encode the key
        string keyToken = Base64Url.Encode(key);
        Console.WriteLine($"Key Token: {keyToken}");

        // Later: decode back to raw key
        byte[] rawKey = Base64Url.Decode(keyToken);
        Console.WriteLine($"Key Length: {rawKey.Length} bytes");
    }
}

Integrating with ASP.NET Core

Embed URL‑safe tokens in query strings or headers:

app.MapGet("/token", () =>
{
    var payload = Encoding.UTF8.GetBytes("user-id=42;exp=1699999999");
    var token = Base64Url.Encode(payload);
    return Results.Ok(new { token });
});

app.MapGet("/validate", (string token) =>
{
    try
    {
        var data = Base64Url.Decode(token);
        string text = Encoding.UTF8.GetString(data);
        return Results.Ok(new { valid = true, text });
    }
    catch (FormatException)
    {
        return Results.BadRequest("Invalid token format.");
    }
});

Common Use Cases

JWT & OIDC – JSON Web Tokens use URL‑safe Base64 for header and payload segments.
Query Parameters – Pass binary data or state tokens without further URL encoding.
Short-Lived URLs – Sign URLs for temporary access (e.g., presigned file downloads).
Embedded Metadata – Include user data in links or forms safely.

Best Practices

Validate Input: Always wrap Decode in try/catch to handle malformed input.
Avoid Manual Padding: Let Base64Url handle padding rules automatically.
Use in HTTPS: Although URL‑safe, still transmit sensitive tokens over secure channels.
Log & Monitor: Track decode failures to detect tampering or abuse.
Cache Heavy Operations: If encoding large blobs frequently, consider caching results.

Conclusion

.NET 9’s Base64Url class simplifies URL‑safe encoding and decoding with a clean, reliable API. Whether you’re building authentication tokens, passing data in query strings, or signing URLs, Base64Url should be your go‑to tool.

Give it a try in your next .NET 9 project, and let me know how you use it!

Happy coding!

Secure Authentication & Authorization in ASP.NET Core 9.0: A Step-by-Step Guide

Leandro Veiga — Sat, 19 Apr 2025 22:21:31 +0000

In this post, we’ll walk through how to implement robust and secure authentication and authorization in ASP.NET Core 9.0. You’ll learn to leverage the newest APIs, configure JWT and cookie authentication, define fine‑grained policies, and apply best practices to protect your web apps and APIs.

Introduction
What’s New in ASP.NET Core 9.0 Auth
Setting Up Authentication
- JWT Bearer Authentication
- Cookie Authentication
Configuring Authorization Policies
Securing Minimal APIs & MVC Endpoints
Best Practices for Secure Auth
Conclusion

Introduction

Authentication verifies who a user is, while authorization controls what they can do. ASP.NET Core 9.0 introduces more streamlined and secure defaults for both. In this guide, we'll:

Explain new authentication/authorization APIs
Show code examples for JWT and cookie auth
Define policy‑ and role‑based access
Apply auth to Minimal APIs and MVC controllers
Cover best practices to harden your application

What’s New in ASP.NET Core 9.0 Auth

ASP.NET Core 9.0 enhances the security and developer experience by:

Simplified Configuration: New extension overloads reduce boilerplate in Program.cs.
Built‑In Secure Defaults: Enforces HTTPS, SameSite cookie mode, and stricter token validation by default.
Endpoint‑Level Authorization: Fine‑grained RequireAuthorization with policy chaining for Minimal APIs.
Improved DI for Auth Handlers: Custom handlers can now request scoped services directly, making policies more powerful.

Setting Up Authentication

In Program.cs, add authentication services before building the app:

var builder = WebApplication.CreateBuilder(args);

// 1. Add Authentication & configure schemes
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidIssuer = builder.Configuration["Jwt:Issuer"],
        ValidAudience = builder.Configuration["Jwt:Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(
            Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
    };
})
.AddCookie("MyCookie", options =>
{
    options.Cookie.HttpOnly = true;
    options.Cookie.SameSite = SameSiteMode.Strict;
    options.LoginPath = "/account/login";
    options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
});

JWT Bearer Authentication

Issue tokens from your auth controller and validate them:

app.MapPost("/token", ([FromServices] IConfiguration config, UserCredentials creds) =>
{
    if (ValidateUser(creds))
    {
        var claims = new[]
        {
            new Claim(ClaimTypes.Name, creds.Username),
            new Claim(ClaimTypes.Role, "Admin")
        };

        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(config["Jwt:Key"]));
        var token = new JwtSecurityToken(
            issuer: config["Jwt:Issuer"],
            audience: config["Jwt:Audience"],
            claims: claims,
            expires: DateTime.UtcNow.AddMinutes(15),
            signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256));

        return Results.Ok(new { token = new JwtSecurityTokenHandler().WriteToken(token) });
    }
    return Results.Unauthorized();
});

Cookie Authentication

For server‑rendered apps or safe XSRF flows, use cookies:

app.MapPost("/account/login", async (HttpContext http, UserCredentials creds) =>
{
    if (ValidateUser(creds))
    {
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, creds.Username),
            new Claim(ClaimTypes.Role, "User")
        };
        var claimsIdentity = new ClaimsIdentity(claims, "MyCookie");
        await http.SignInAsync("MyCookie", new ClaimsPrincipal(claimsIdentity));
        return Results.Redirect("/");
    }
    return Results.Unauthorized();
});

Configuring Authorization Policies

Define policies in Program.cs before builder.Build():

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy =>
        policy.RequireAuthenticatedUser()
              .RequireRole("Admin"));

    options.AddPolicy("Over18", policy =>
        policy.RequireClaim("DateOfBirth")
              .RequireAssertion(context =>
    {
        var dob = DateTime.Parse(context.User.FindFirstValue("DateOfBirth")!);
        return (DateTime.Today - dob).TotalDays >= 18 * 365;
    }));
});

Use custom authorization handlers for complex logic:

public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>
{
    protected override Task HandleRequirementAsync(
      AuthorizationHandlerContext context,
      MinimumAgeRequirement requirement)
    {
        if (context.User.HasClaim(c => c.Type == ClaimTypes.DateOfBirth) &&
            DateTime.TryParse(context.User.FindFirstValue(ClaimTypes.DateOfBirth), out var dob))
        {
            var age = (DateTime.Today - dob).TotalDays / 365;
            if (age >= requirement.MinimumAge) context.Succeed(requirement);
        }
        return Task.CompletedTask;
    }
}

Securing Minimal APIs & MVC Endpoints

After app.UseAuthentication(); app.UseAuthorization();, apply policies:

Minimal API

app.MapGet("/admin/data", () => "Secret Data")
   .RequireAuthorization("AdminOnly");

MVC Controller

[Authorize(Policy = "Over18")]
public class ContentController : Controller
{
    public IActionResult AdultSection() => View();
}

Best Practices for Secure Auth

Use HTTPS Everywhere: Enforce app.UseHttpsRedirection().
Short‑Lived Tokens & Refresh: Limit exposure if a token is stolen.
Secure Cookie Flags: HttpOnly, Secure, SameSite=Strict.
Validate Inputs & Claims: Never trust unvalidated data in claims.
Centralize Policy Definitions: Keep auth rules in one place.
Monitor & Log: Track failed logins, token validation errors, and policy denials.

Conclusion

Secure authentication and authorization are critical for any modern web application. ASP.NET Core 9.0’s new APIs make it easier to configure robust auth flows, from JWT to cookie schemes, plus powerful policy‑based authorization. By following the examples and best practices above, you can build applications that are both secure and maintainable.

Feel free to leave questions or feedback in the comments below—happy coding!

Deploying .NET 8 Minimal APIs to Azure with CI/CD: A Step-by-Step Guide

Leandro Veiga — Wed, 16 Apr 2025 22:13:09 +0000

In this post, we'll explore how to deploy your .NET 8 Minimal APIs to Azure using CI/CD pipelines. Leveraging automated deployment tools like GitHub Actions or Azure Pipelines can streamline your release process, reduce manual errors, and allow you to focus on building great applications.

Introduction
Prerequisites
Preparing Your .NET 8 Minimal API Project
Setting Up CI/CD Pipelines
- Using GitHub Actions
- Using Azure Pipelines
Best Practices for CI/CD Deployments
Conclusion

Introduction

Deploying your .NET 8 Minimal APIs to Azure is a critical step in delivering your application to users. Automating this process with CI/CD pipelines can significantly enhance your development workflow. In this guide, we will walk through setting up a CI/CD pipeline using both GitHub Actions and Azure Pipelines, providing code examples and best practices along the way.

Prerequisites

Before getting started, ensure you have the following:

A working .NET 8 Minimal API project.
An active Azure account.
An Azure App Service for hosting your API.
A GitHub repository for your project (if using GitHub Actions) or Azure DevOps account (if using Azure Pipelines).

Preparing Your .NET 8 Minimal API Project

For demonstration, let's assume your project structure is similar to the following:

MyMinimalApi/
├── Program.cs
├── MyMinimalApi.csproj
└── appsettings.json

In your Program.cs, you might have something like:

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.MapGet("/", () => "Hello from .NET 8 Minimal API!");

app.Run();

Make sure your API is ready for production by configuring settings such as environment variables, logging, and error handling.

Setting Up CI/CD Pipelines

Using GitHub Actions

GitHub Actions provides an easy way to automate your deployment process. Create a workflow file in your repository at .github/workflows/azure-deploy.yml:

name: Deploy to Azure

on:
  push:
    branches:
      - main

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Setup .NET
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.x'

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --configuration Release --no-restore

      - name: Publish
        run: dotnet publish -c Release -o ./publish --no-build

      - name: Deploy to Azure Web App
        uses: azure/webapps-deploy@v2
        with:
          app-name: YOUR_AZURE_APP_SERVICE_NAME
          publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
          package: ./publish

Explanation:

This workflow triggers on pushes to the main branch.
It checks out your repository, sets up the .NET environment, restores dependencies, builds, and publishes your project.
Finally, it deploys the published files to your Azure Web App using a publish profile stored in GitHub Secrets.

Using Azure Pipelines

If you prefer using Azure Pipelines, create a file named azure-pipelines.yml in the root of your repository:

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  buildConfiguration: 'Release'

steps:
- task: UseDotNet@2
  inputs:
    packageType: 'sdk'
    version: '8.0.x'
    installationPath: $(Agent.ToolsDirectory)/dotnet

- script: |
    dotnet restore
  displayName: 'Restore Dependencies'

- script: |
    dotnet build --configuration $(buildConfiguration) --no-restore
  displayName: 'Build Project'

- script: |
    dotnet publish --configuration $(buildConfiguration) -o $(Build.ArtifactStagingDirectory) --no-build
  displayName: 'Publish Project'

- task: PublishBuildArtifacts@1
  inputs:
    PathtoPublish: '$(Build.ArtifactStagingDirectory)'
    ArtifactName: 'drop'

- task: AzureWebApp@1
  inputs:
    azureSubscription: 'YOUR_AZURE_SUBSCRIPTION'
    appType: 'webApp'
    appName: 'YOUR_AZURE_APP_SERVICE_NAME'
    package: '$(Build.ArtifactStagingDirectory)'

Explanation:

This pipeline is triggered on the main branch.
It uses a hosted Ubuntu agent, restores dependencies, builds, and publishes your project.
The built artifacts are then deployed to your Azure Web App.

Best Practices for CI/CD Deployments

Automate Testing: Integrate automated tests in your pipeline to catch issues before deployment.
Use Secrets Management: Store sensitive information such as API keys and publish profiles in secure vaults or CI/CD secret stores.
Implement Rollbacks: Consider strategies to automatically rollback deployments if errors occur.
Monitor Deployments: Utilize Azure Monitor and Application Insights to track the health and performance of your deployed application.
Version Control: Tag your releases and maintain version history to facilitate easier deployments and troubleshooting.

Conclusion

Automating the deployment of your .NET 8 Minimal APIs with CI/CD pipelines on Azure can significantly enhance your development workflow and ensure reliable delivery of your applications. Whether you choose GitHub Actions or Azure Pipelines, using the best practices from this guide will help you build a robust and secure deployment process.

Happy coding, and feel free to share your thoughts or questions in the comments below!

Building RESTful APIs with .NET 8: Essential Best Practices for Performance and Security

Leandro Veiga — Tue, 08 Apr 2025 18:00:00 +0000

In this guide, we will discuss how to build RESTful APIs with .NET 8 that are both high-performance and secure. Whether you’re new to API development or looking to enhance your current projects, this article walks you through the best practices, practical examples, and key strategies to create robust RESTful APIs using .NET 8.

Introduction
Understanding RESTful APIs in .NET 8
Setting Up Your .NET 8 API Project
Code Samples: Building a Simple RESTful API
Best Practices for Performance
Best Practices for Security
Conclusion

Introduction

RESTful APIs are the backbone of modern web and mobile applications, allowing easy communication and data exchange across platforms. With .NET 8, developers can leverage powerful features to build APIs that are not only efficient and scalable but also secure against common threats. This article provides a comprehensive overview of techniques and practices necessary to achieve these goals.

Understanding RESTful APIs in .NET 8

REST (Representational State Transfer) is a popular architectural style that uses standard HTTP methods for communication. In the context of .NET 8, RESTful APIs benefit from:

Minimal API Enhancements: Simplified routing and fewer boilerplate codes.
Integrated Middleware: Built-in support for dependency injection, authentication, and authorization.
High Performance: Optimized for low latency and efficient resource utilization.

Understanding these fundamentals is the first step in creating powerful RESTful services.

Setting Up Your .NET 8 API Project

To get started with building a RESTful API in .NET 8, follow these simple steps:

Create a New Project:

dotnet new web -n RestfulApiExample
cd RestfulApiExample

Configure the Project:

Use the default setup which includes essential middleware components in Program.cs. We’ll build upon this structure to incorporate best practices for performance and security.

Code Samples: Building a Simple RESTful API

Below is an example of a minimal RESTful API built with .NET 8. This endpoint fetches a list of products as an example.

using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;

var builder = WebApplication.CreateBuilder(args);

// Register services (e.g., database context, repositories, etc.)
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

// Enable middleware for development
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

// Global middleware for error handling (optional and recommended)
app.UseExceptionHandler("/error");

// Basic GET endpoint for products
app.MapGet("/products", () =>
{
    var products = new[]
    {
        new { Id = 1, Name = "Laptop", Price = 999.99 },
        new { Id = 2, Name = "Smartphone", Price = 499.99 },
        new { Id = 3, Name = "Tablet", Price = 299.99 }
    };
    return Results.Ok(products);
})
.WithName("GetProducts")
.Produces(200);

app.Run();

Explanation

Minimal APIs: We use minimal API syntax to create cleaner and more efficient endpoints.
Swagger Integration: Adding Swagger supports API documentation which is essential for development and debugging.
Error Handling: Global error handling middleware improves reliability and security by avoiding unhandled exceptions.

Best Practices for Performance

To ensure your RESTful API performs optimally, consider these best practices:

Caching

Use in-memory caching or distributed caching (e.g., Redis) to reduce database calls.
Cache frequently accessed data.

Asynchronous Programming

Make use of async/await to prevent thread blocking.
Optimize I/O operations to scale under heavy loads.

Rate Limiting

Implement rate limiting to prevent abuse and ensure fair usage among clients.
Utilize built-in middleware in .NET 8 or external libraries.

Profiling and Monitoring

Monitor your API with tools such as Application Insights, Prometheus, or ELK Stack.
Regularly profile your application to identify performance bottlenecks.

Best Practices for Security

Securing your API is crucial. Here are some effective strategies:

Authentication and Authorization

Use robust authentication mechanisms like JWT (JSON Web Tokens) or OAuth2.
Implement role-based access control to authorize user actions.

HTTPS

Enforce HTTPS to secure data in transit.
Redirect HTTP requests to HTTPS using middleware.

Data Validation

Validate all input data to prevent SQL injection, XSS, and other common attacks.
Use data annotations and custom validation logic where appropriate.

Error Handling

Avoid exposing sensitive error information in production.
Use custom error pages and logging for monitoring purposes.

CORS (Cross-Origin Resource Sharing)

Configure CORS policies to restrict which domains can access your API.
Protect your API from unauthorized cross-origin requests.

Conclusion

Building RESTful APIs with .NET 8 offers a modern approach to developing high-performance, secure services. By following the best practices for both performance and security, you ensure that your API not only meets business requirements but also provides a smooth and secure experience for users. Whether you’re leveraging minimal API enhancements or traditional MVC patterns, the strategies and examples provided in this guide will help you design robust, maintainable APIs.

Happy coding, and feel free to leave your thoughts or questions in the comments below!

Integrating Azure Cognitive Services in .NET 8 Minimal APIs: A Practical AI Guide

Leandro Veiga — Sat, 05 Apr 2025 15:53:39 +0000

In this post, we'll explore how to harness the power of Azure Cognitive Services within your .NET 8 Minimal APIs. Whether you're building applications that require sentiment analysis, language detection, or image processing, integrating Azure AI services can help elevate your application's intelligence with minimal effort.

Introduction
Why Use Azure Cognitive Services with .NET 8 Minimal APIs?
Setting Up Your Azure Cognitive Services Environment
Code Example: Integrating Cognitive Services into a Minimal API
Best Practices and Usage Guidelines
Conclusion

Introduction

Microsoft Azure Cognitive Services offer a suite of AI-powered tools that can analyze text, images, videos, and more. By integrating these services into your .NET 8 Minimal APIs, you can build smarter applications that provide advanced functionality—such as sentiment analysis or image recognition—with minimal setup.

In this guide, we'll walk through the process of setting up Azure Cognitive Services and demonstrate how to incorporate AI features into your API endpoints.

Why Use Azure Cognitive Services with .NET 8 Minimal APIs?

.NET 8 Minimal APIs provide a lightweight and efficient way to build HTTP APIs with less boilerplate code. Combining this approach with Azure Cognitive Services gives you several advantages:

Rapid AI Integration: Quickly add AI capabilities such as language understanding, sentiment analysis, and translation.
Scalability: Leverage Azure's scalable cloud services to handle large volumes of data or high request rates.
Simplicity: Use a lean codebase to implement complex AI features without overcomplicating your project.
Flexibility: Integrate various AI models provided by Azure to tailor your solution to specific business needs.

Setting Up Your Azure Cognitive Services Environment

Before integrating Azure Cognitive Services in your .NET application, you'll need to:

1. Create a Cognitive Services Resource

Log in to the Azure Portal.
Create a new Cognitive Services resource (e.g., for Text Analytics or Computer Vision).
Note your endpoint URL and API key.

2. Store the Credentials Securely

Use environment variables or a secure secrets store to manage your Azure Cognitive Services endpoint and API key.

Assumed environment variables:

AZURE_COGNITIVE_ENDPOINT
AZURE_COGNITIVE_KEY

3. Install Necessary NuGet Packages

For Text Analytics, run the following command:

dotnet add package Azure.AI.TextAnalytics

Code Example: Integrating Cognitive Services into a Minimal API

Here’s a practical example showing how to use Azure Text Analytics in a .NET 8 Minimal API to perform sentiment analysis.

using Azure;
using Azure.AI.TextAnalytics;
using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;

// Create the web application builder.
var builder = WebApplication.CreateBuilder(args);

// Retrieve Azure Cognitive Services credentials from configuration.
string azureEndpoint = builder.Configuration["AZURE_COGNITIVE_ENDPOINT"];
string azureApiKey = builder.Configuration["AZURE_COGNITIVE_KEY"];

// Register the TextAnalyticsClient as a singleton for dependency injection.
builder.Services.AddSingleton(new TextAnalyticsClient(new Uri(azureEndpoint), new AzureKeyCredential(azureApiKey)));

var app = builder.Build();

// Define a Minimal API endpoint for sentiment analysis.
app.MapPost("/analyze-sentiment", async (TextAnalyticsClient client, SentimentRequest sentimentRequest) =>
{
    if (string.IsNullOrWhiteSpace(sentimentRequest.InputText))
    {
        return Results.BadRequest("Input text is required.");
    }

    // Call Azure Cognitive Services to analyze the sentiment.
    var response = await client.AnalyzeSentimentAsync(sentimentRequest.InputText);

    return Results.Ok(response.Value);
});

app.Run();

public record SentimentRequest(string InputText);

🧠 Explanation

Configuration: The endpoint and key are loaded from environment variables.
Dependency Injection: TextAnalyticsClient is injected directly into the endpoint.
Endpoint Logic: /analyze-sentiment receives input, calls Azure's API, and returns the sentiment.

You can expand this example to support translation, language detection, and image processing.

Best Practices and Usage Guidelines

🔐 Secure Your Credentials

Always store API keys and endpoints in environment variables or a secret manager.
Never commit sensitive data to source control.

⚠️ Error Handling and Resilience

Handle service failures, API timeouts, and rate limits.
Use retry policies and circuit breakers for fault tolerance.

⚡ Optimize Performance

Cache responses when appropriate to reduce repeated calls.
Use async/await for non-blocking I/O operations.

📊 Monitor and Log

Log request/response metadata to track usage and troubleshoot issues.
Use Azure Monitor or Application Insights for insights.

✅ Test Thoroughly

Write unit and integration tests to simulate real-world usage and roles.
Validate your API under various load and error conditions.

Conclusion

Integrating Azure Cognitive Services with .NET 8 Minimal APIs enables you to build intelligent, responsive applications with minimal overhead. By following the steps and best practices outlined in this guide, you can quickly add AI functionality to your applications—whether it’s sentiment analysis, language detection, or any other cognitive feature.

I hope you found this guide helpful and inspiring as you venture into building smarter applications. Feel free to share your experiences, ask questions, or leave feedback in the comments below!

Happy coding!

Securing Multi-Tier Applications with .NET 8: Role-Based Authorization Best Practices

Leandro Veiga — Tue, 01 Apr 2025 15:41:48 +0000

In today’s guide, we will explore how to implement role-based authorization in .NET 8 to secure your multi-tier applications. Effective access control is crucial for protecting sensitive resources and ensuring that only authorized users can perform specific actions. In this article, you'll discover practical examples, configuration techniques, and best practices to build secure, multi-tier systems.

Introduction
Overview of Role-Based Authorization
Configuring Role-Based Authorization in .NET 8
Code Examples
- Minimal API Example
- MVC Controller Example
Best Practices for Secure Multi-Tier Applications
Conclusion

Introduction

As applications scale and evolve, maintaining secure access across multiple tiers of an application becomes a top priority. Role-based authorization is a powerful strategy to ensure that users can only access resources or perform actions that align with their roles. This separation of concerns is essential for both security and maintainability across your backend services, APIs, and front-end layers.

In this guide, we'll look at:

What role-based authorization is and why it's important.
How to configure .NET 8 to support role-based access control.
Real-world examples using both Minimal APIs and MVC controllers.
Best practices to ensure your multi-tier application is secure and scalable.

Overview of Role-Based Authorization

Role-based authorization controls access based on the user’s assigned roles. This approach involves:

Defining User Roles: Determining roles such as Admin, User, Manager, etc.
Assigning Roles: Attaching roles to user identities (typically during authentication).
Enforcing Policies: Using policies and attributes to restrict access to resources based on roles.

By leveraging these mechanisms, developers can prevent unauthorized access and ensure that each part of the application is accessed only by users with proper privileges.

Configuring Role-Based Authorization in .NET 8

.NET 8 offers robust support for authentication and authorization right out of the box. To enable role-based access, you'll typically perform the following steps in your application:

Setup Authentication: Configure an authentication scheme (e.g., cookies, JWT, etc.) that returns user claims including roles.
Define Authorization Policies: Use the built-in authorization services to create policies that specify required roles.
Secure Endpoints: Apply the [Authorize] attribute or equivalent mechanisms to restrict endpoints to specific roles.

Code Examples

Minimal API Example

Below is a simple example demonstrating how to implement role-based authorization in a .NET 8 Minimal API:

using Microsoft.AspNetCore.Authorization;
using System.Security.Claims;

var builder = WebApplication.CreateBuilder(args);

// Configure authentication (using cookie authentication as an example)
builder.Services.AddAuthentication("MyCookieScheme")
    .AddCookie("MyCookieScheme", options =>
    {
        options.LoginPath = "/login";
    });

// Configure authorization with role-based policies
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
    options.AddPolicy("UserOnly", policy => policy.RequireRole("User"));
});

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

// Public endpoint
app.MapGet("/", (ClaimsPrincipal user) =>
    $"Hello {user.Identity?.Name ?? "Guest"}!");

// Endpoint restricted to Admins
app.MapGet("/admin", [Authorize(Policy = "AdminOnly")] () =>
    "Welcome, Admin!").RequireAuthorization("AdminOnly");

app.Run();

MVC Controller Example

For applications using MVC, role-based authorization can be applied to controllers or actions directly:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace MyApp.Controllers
{
    [Authorize]
    public class DashboardController : Controller
    {
        // This action is accessible by all authorized users
        public IActionResult Index()
        {
            return View();
        }

        // This action is restricted to users with the "Manager" role
        [Authorize(Roles = "Manager")]
        public IActionResult ManagerSection()
        {
            return View();
        }
    }
}

Best Practices for Secure Multi-Tier Applications

Design Clear Role Hierarchies

Define roles that align with organizational responsibilities and security requirements.
Avoid overly granular or overlapping roles that can complicate the access control logic.

Centralize Authorization Policies

Manage role-based policies in a centralized configuration to ensure consistency.
Update policies as the application evolves or as new roles are introduced.

Ensure Secure Role Assignment

Validate and sanitize role information during user authentication.
Store roles securely in your identity provider or database.

Implement Logging and Monitoring

Log authorization failures to detect potential security breaches.
Monitor role usage to understand access patterns and adjust policies accordingly.

Test Role-Based Scenarios

Implement unit and integration tests to simulate different user roles.
Verify that access restrictions perform as expected under various conditions.

Conclusion

Securing multi-tier applications with role-based authorization in .NET 8 provides a robust framework for controlling access and protecting sensitive resources. By following the configuration steps and best practices outlined in this guide, you can build scalable, secure applications that enforce proper access control across all layers.

I hope this article sheds light on how to implement role-based access control effectively in your .NET 8 applications. Feel free to share your experiences, ask questions, or provide feedback in the comments below!

Happy coding! 🚀

Implementing Rate Limiting and Throttling in .NET 8: Safeguard Your Backend Services

Leandro Veiga — Sat, 29 Mar 2025 00:41:52 +0000

In today's post, we’re diving into rate limiting and throttling in .NET 8, a crucial technique to protect your backend services from overload. With the ever-increasing number of client requests, it's essential to incorporate mechanisms that will control traffic and ensure your ASP.NET 8 applications remain robust and responsive.

Introduction
Understanding Rate Limiting and Throttling
Built-in Rate Limiting in .NET 8
Coding Example: Implementing Rate Limiting
Best Practices and Usage Scenarios
Conclusion

Introduction

As modern applications become more complex and handle increasing volumes of traffic, managing the flow of incoming requests becomes paramount. Rate limiting and throttling are strategies designed to protect services by controlling how often clients can make requests. In .NET 8, leveraging built-in middleware and configuration options can help implement these techniques easily.

In this guide, we will:

Define rate limiting and throttling and explain why they are essential.
Explore .NET 8’s built-in support for implementing these features.
Look at real-world code examples.
Discuss best practices for configuring your policies.

Understanding Rate Limiting and Throttling

Rate limiting restricts the number of requests a client can make within a certain time period. This helps prevent spam, DDoS attacks, and ensures that resources are shared equitably among all users. Throttling, on the other hand, manages the speed at which requests are accepted or processed.

Key objectives include:

Protecting the backend services from being inundated with requests.
Maintaining a fair distribution of server resources.
Improving application stability and user experience.

Built-in Rate Limiting in .NET 8

With .NET 8, the framework now includes built-in middleware to handle rate limiting, making it easier than ever to integrate this functionality into your applications. The middleware allows you to define various policies, such as fixed window, sliding window, and token bucket algorithms.

Using these policies, you can customize the behavior for different endpoints or globally, ensuring flexible and powerful traffic management.

Coding Example: Implementing Rate Limiting

Below is a simple example of how to implement rate limiting in an ASP.NET 8 application using the built-in middleware.

using Microsoft.AspNetCore.RateLimiting;
using System.Threading.RateLimiting;

var builder = WebApplication.CreateBuilder(args);

// Add Rate Limiter services with a Fixed Window policy.
builder.Services.AddRateLimiter(options =>
{
    // Define a fixed window rate limiter policy.
    options.AddFixedWindowLimiter(policyName: "Fixed", options =>
    {
        options.PermitLimit = 10; // Maximum requests allowed per window.
        options.Window = TimeSpan.FromSeconds(10); // Time window.
        options.QueueLimit = 2; // Max queued requests.
        options.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
    });
});

var app = builder.Build();

// Use the rate limiter middleware.
app.UseRateLimiter();

// Example endpoint that will be rate limited.
app.MapGet("/", () => "Hello, World!").RequireRateLimiting("Fixed");

app.Run();

Explanation

The code above registers a fixed window rate limiter policy, limiting the endpoint to 10 requests every 10 seconds with a small queue buffer.
The UseRateLimiter middleware is added to the application pipeline, ensuring that rate limiting rules are enforced on incoming requests.
The endpoint / is configured to use the "Fixed" policy, meaning any traffic to this route will be throttled according to the defined rules.

Best Practices and Usage Scenarios

When implementing rate limiting and throttling in your applications, consider the following best practices:

Policy Customization

Define different policies for different endpoints. A public API may have stricter limits than internal endpoints.
Consider using sliding or token bucket algorithms for smoother request flows where appropriate.

Graceful Degradation

When limits are exceeded, ensure your application returns informative error responses (e.g., HTTP 429 Too Many Requests) to help clients adjust their behavior.
Optionally implement Retry-After headers.

Monitoring and Logging

Track usage metrics to identify abuse or unusual traffic patterns.
Use logging to monitor the performance of rate-limiting policies.

Testing

Thoroughly test your rate-limiting strategy under simulated load conditions to ensure that legitimate users are not inadvertently penalized.
Use tools like Postman or automated tests to emulate various request patterns.

Hybrid Approaches

Combine rate limiting with other security measures such as IP filtering, authentication, and CDN protections for a comprehensive defense strategy.

Conclusion

Rate limiting and throttling are essential features for maintaining the health and performance of your backend services. With .NET 8’s robust, built-in middleware, implementing these strategies has never been easier. By following the techniques and best practices discussed in this article, you can ensure that your ASP.NET applications remain resilient under heavy traffic while protecting your critical resources.

I hope this guide empowers you to take practical steps in safeguarding your services. If you have any questions, suggestions, or would like to share your experiences, feel free to leave a comment below!

Happy coding! 🚀

Enhancing HTTP Pipelines with Custom Middleware in .NET 8: Tips, Code, and Best Practices

Leandro Veiga — Wed, 19 Mar 2025 21:00:00 +0000

In this post, we'll explore how to create custom middleware in .NET 8 that can optimize and enhance your HTTP request pipeline. Custom middleware offers a powerful way to inject custom logic into every request and response, allowing you to implement logging, security, performance enhancements, and much more.

Introduction
What is Middleware in .NET?
Creating Custom Middleware in .NET 8
Code Example: Custom Header Middleware
Best Practices for Developing Middleware
Usage Scenarios and Tips
Conclusion

Introduction

Middleware in ASP.NET Core is a critical component of the request processing pipeline. By constructing a sequence of middleware, developers can handle, modify, or even terminate HTTP requests according to custom logic. With .NET 8, creating and integrating custom middleware has become more straightforward, allowing you to tailor your application's behavior to the specific needs of your project.

In this article, we’ll cover:

The fundamentals of middleware in .NET.
How to build custom middleware.
Real-world code examples.
Best practices for middleware design and usage.

What is Middleware in .NET?

Middleware is software that sits between the incoming HTTP request and the execution of your application logic. It acts as a filter, performing tasks such as:

Logging or monitoring requests.
Implementing authentication and authorization.
Modifying request or response objects.
Handling errors and exceptions globally.

In ASP.NET Core, every component in the request pipeline is built as middleware. Each middleware component is responsible for invoking the next middleware in the pipeline or short-circuiting the pipeline based on custom conditions.

Creating Custom Middleware in .NET 8

Creating custom middleware in .NET 8 involves creating a class that encapsulates your desired logic and then integrating that middleware into the HTTP request pipeline. The key steps include:

Defining a class that accepts a RequestDelegate.
Implementing an asynchronous invocation method (often named InvokeAsync).
Injecting your middleware using the built-in UseMiddleware extension method.

Let's put these steps into practice with a sample middleware that adds a custom header to every HTTP response.

Code Example: Custom Header Middleware

Below is the code for a simple custom middleware that injects an X-Custom-Header with a specific value into every response:

using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;

public class CustomHeaderMiddleware
{
    private readonly RequestDelegate _next;

    public CustomHeaderMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // Before invoking the next middleware, you can inspect or modify the request.
        // For example, add a custom header to the response.
        context.Response.OnStarting(() => {
            context.Response.Headers.Add("X-Custom-Header", "MiddlewareExample");
            return Task.CompletedTask;
        });

        // Call the next middleware in the pipeline.
        await _next(context);
    }
}

Integrating the Middleware

To integrate the custom middleware, use the UseMiddleware<T>() extension method in your Program.cs or Startup.cs file:

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

// Register the custom middleware
app.UseMiddleware<CustomHeaderMiddleware>();

app.MapGet("/", () => "Hello from .NET 8 with Custom Middleware!");

app.Run();

In this example, every HTTP response generated by your application will include the X-Custom-Header header with its configured value.

Best Practices for Developing Middleware

When developing custom middleware in .NET 8, consider the following best practices:

Keep It Focused: Design middleware to perform a single responsibility rather than consolidating multiple concerns. This simplifies debugging and future enhancements.
Leverage Dependency Injection (DI): If your middleware requires additional services, use constructor injection to access them seamlessly.
Asynchronous Programming: Always use asynchronous programming patterns (async/await) to ensure that your middleware scales well under load.
Error Handling: Integrate with global exception handling middleware or include robust error handling within your middleware to prevent unhandled exceptions.
Short-Circuiting When Necessary: If the middleware logic determines that the request should not proceed further (e.g., unauthorized access), use short-circuiting to return an appropriate response immediately.

Usage Scenarios and Tips

Custom middleware can be applied in many scenarios:

Logging and Monitoring: Record request details for auditing or performance analysis.
Security Enhancements: Implement rate limiting, IP filtering, or add custom security headers.
Performance Optimizations: Cache results or bypass expensive computations for static content.
Content Transformation: Modify request payloads or response bodies before further processing.

Remember to order your middleware appropriately in the pipeline, as the sequence can influence how requests and responses are processed.

Conclusion

Custom middleware in .NET 8 opens up a realm of possibilities to enhance the HTTP request pipeline with your specialized logic. By following the best practices and coding patterns discussed in this guide, you can build robust, maintainable, and scalable middleware to address various challenges in your application.

I hope this post helps you understand how to create and use custom middleware effectively. Feel free to share your thoughts, ask questions, or provide feedback in the comments below!

Happy coding!

Optimizing .NET 8 Minimal APIs for Cloud-Native Microservices: Docker & Kubernetes Best Practices

Leandro Veiga — Wed, 19 Mar 2025 00:35:12 +0000

In today’s digital world, microservices and cloud-native architectures are becoming the backbone of scalable systems. With .NET 8 and its minimal API capabilities, you can build lean, efficient APIs that perform well in containerized environments on Kubernetes or Docker. In this post, we will explore best practices, provide code examples, and share tips for optimizing your minimal APIs.

Introduction
Understanding Minimal APIs in .NET 8
Optimization Strategies for Cloud-Native Environments
Containerizing Your .NET 8 API with Docker
Deploying on Kubernetes
Best Practices for Cloud-Native Minimal APIs
Conclusion

Introduction

With the rise of microservices, developing lightweight, high-performance APIs has become essential. .NET 8’s minimal APIs help reduce boilerplate while delivering blazing-fast startup times. However, optimizing these APIs for cloud-native environments such as Docker and Kubernetes requires additional considerations. This guide is aimed at developers working with microservices and those embracing a cloud-native approach.

Understanding Minimal APIs in .NET 8

Minimal APIs in .NET 8 simplify the process of building Web APIs by eliminating unnecessary complexity. Instead of relying on large controllers and numerous configuration files, you can configure your endpoints in a single file.

Basic Example

using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Hosting;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

app.MapGet("/", () => "Hello, .NET 8 Minimal API!");

app.MapGet("/weather/{city}", (string city) =>
{
    return $"The weather in {city} is sunny!";
});

app.Run();

This streamlined approach reduces overhead and is perfect for microservice scenarios.

Optimization Strategies for Cloud-Native Environments

Optimizing your minimal APIs for cloud deployment involves several strategies:

Performance Tuning:

Enable ahead-of-time (AOT) compilation to reduce startup times.
Utilize asynchronous programming to enhance throughput.
Use caching strategies (memory cache, distributed cache) for frequently requested data.

Observability & Logging:

Integrate logging frameworks like Serilog.
Utilize distributed tracing and monitoring (e.g., Prometheus, Grafana).

Configuration & Security:

Externalize configurations using environment variables.
Use API gateways or service meshes for security and routing.

Scalability:

Implement rate limiting and circuit breaker patterns.
Design your architecture for horizontal scaling.

Containerizing Your .NET 8 API with Docker

To deploy your API to a cloud-native environment, containerization is a crucial step.

Dockerfile Example

# Use the official .NET 8 SDK image to build the app.
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src

# Copy the project files and restore dependencies.
COPY *.csproj ./
RUN dotnet restore

# Copy the rest of the source code and publish the app.
COPY . ./
RUN dotnet publish -c Release -o /app/publish

# Use the official .NET 8 runtime image.
FROM mcr.microsoft.com/dotnet/aspnet:8.0
WORKDIR /app
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "YourApiProjectName.dll"]

Explanation

Multi-stage Build: The first stage builds and publishes the application, while the second stage packages it into a lightweight runtime image.
Port Exposure: Ensure your application listens to the correct port (configured via environment variables or code).

Deploying on Kubernetes

Once your API is containerized, you can deploy it to Kubernetes for robust orchestration and scaling.

Kubernetes Deployment Manifest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: dotnet-minimal-api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: dotnet-minimal-api
  template:
    metadata:
      labels:
        app: dotnet-minimal-api
    spec:
      containers:
      - name: dotnet-minimal-api
        image: yourdockerhubusername/yourapiimage:latest
        ports:
        - containerPort: 80
        env:
        - name: ASPNETCORE_ENVIRONMENT
          value: "Production"
---
apiVersion: v1
kind: Service
metadata:
  name: dotnet-minimal-api-service
spec:
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 80
  selector:
    app: dotnet-minimal-api

Explanation

Deployment: Defines a deployment with 3 replicas for high availability.
Service: A LoadBalancer service to expose the API externally while balancing the traffic.

Best Practices for Cloud-Native Minimal APIs

To get the most out of your cloud-native minimal APIs on .NET 8, consider the following best practices:

Embrace Asynchronous Programming:

Use async/await patterns throughout your API to exploit the benefits of non-blocking I/O.

Externalize Configuration:

Store configuration in external sources (e.g., Kubernetes ConfigMaps, Azure App Configuration) to avoid hard-coded settings.

Implement Resilience Patterns:

Leverage libraries such as Polly for retries, circuit breaking, and fallback mechanisms.

Optimize Startup Time:

Utilize minimal dependencies and consider AOT compilation where applicable.

Focus on Security:

Secure endpoints with proper authentication and authorization.
Use HTTPS, token validation, and API gateways.

Monitoring & Logging:

Continuously monitor your API performance and log relevant metrics.
Utilize cloud-native tools for real-time insights.

Conclusion

Optimizing .NET 8 Minimal APIs for cloud-native environments involves more than just code improvements. Containerization with Docker and deployment on Kubernetes play a crucial role in scalability and resilience. By using the strategies and practices outlined in this post, you can build highly efficient and cloud-optimized microservices.

For more insights, stay tuned for additional content on microservices development and best practices!

Achieving Zero Downtime Deployment with YARP: Blue-Green and Canary Strategies

Leandro Veiga — Mon, 10 Mar 2025 19:00:00 +0000

Zero downtime deployments are critical for systems that demand high availability. In this article, we’ll explore how to use YARP (Yet Another Reverse Proxy) to achieve deployments with no downtime by implementing strategies like blue-green deployments and canary releases. We’ll cover practical code examples, configuration setups, and best practices for a smooth rollout.

Introduction
Why Zero Downtime Deployments?
Understanding YARP
Blue-Green Deployment with YARP
- Configuration Example
Canary Releases with YARP
- Configuration Example
Best Practices
Conclusion
References

Introduction

Continuous deployments are crucial in today's fast-paced tech environment. One of the biggest challenges is updating your application without affecting your users. By combining the power of YARP with deployment strategies like blue-green and canary releases, you can deploy new versions seamlessly and ensure zero downtime for your users.

This article will walk you through the step-by-step process to set up these deployment techniques using YARP, demonstrating the configurations and code needed to make your deployments both safe and efficient.

Why Zero Downtime Deployments?

Zero downtime deployments allow you to:

Roll out updates without interrupting service.
Minimize risk by controlling exposure of new changes.
Ensure a smooth user experience, as the transition between versions is virtually invisible to end users.

Understanding YARP

YARP (Yet Another Reverse Proxy) is an open-source project by Microsoft that enables you to build high-performance reverse proxies. With its flexible configuration system, YARP can be used to implement complex routing scenarios, making it ideal for advanced deployment strategies such as blue-green deployments and canary releases.

Blue-Green Deployment with YARP

Blue-green deployment is a technique where two identical environments (blue and green) are maintained. One environment is live (blue) while the other (green) is updated. Once the new version (green) is fully tested, traffic is switched over from blue to green with no downtime.

Configuration Example

Assume you have two clusters in your configuration—one for blue and one for green. You can switch traffic between them by changing the route’s cluster mapping.

appsettings.json (Initial Configuration)

{
  "ReverseProxy": {
    "Routes": [
      {
        "RouteId": "blueGreenRoute",
        "ClusterId": "blueCluster",
        "Match": {
          "Path": "/api/{**catch-all}"
        }
      }
    ],
    "Clusters": {
      "blueCluster": {
        "Destinations": {
          "blueDestination": {
            "Address": "https://blue.example.com/"
          }
        }
      },
      "greenCluster": {
        "Destinations": {
          "greenDestination": {
            "Address": "https://green.example.com/"
          }
        }
      }
    }
  }
}

Switching to Green Environment

{
  "ReverseProxy": {
    "Routes": [
      {
        "RouteId": "blueGreenRoute",
        "ClusterId": "greenCluster",
        "Match": {
          "Path": "/api/{**catch-all}"
        }
      }
    ]
  }
}

This switch, when executed properly, ensures that your application is updated without impacting user experience.

Canary Releases with YARP

Canary releases involve rolling out new versions to a small subset of users before a full-scale deployment. This approach allows you to monitor the new release's performance and stability in a controlled environment.

Configuration Example

YARP’s flexible routing allows you to set up canary releases by splitting traffic between two clusters. You might direct 90% of traffic to the stable version and 10% to the new version.

appsettings.json (Canary Release)

{
  "ReverseProxy": {
    "Routes": [
      {
        "RouteId": "canaryRoute",
        "ClusterId": "defaultCluster",
        "Match": {
          "Path": "/api/{**catch-all}"
        }
      }
    ],
    "Clusters": {
      "defaultCluster": {
        "LoadBalancingPolicy": "CookieSticky",
        "Destinations": {
          "stableVersion": {
            "Address": "https://stable.example.com/"
          },
          "canaryVersion": {
            "Address": "https://canary.example.com/",
            "Metadata": {
              "Weight": "10"
            }
          }
        }
      }
    }
  }
}

In this configuration, you can adjust the weights to control how much traffic flows to each destination. For example, setting a higher weight for the stable version ensures that most traffic goes there while the canary version only gets a small percentage for testing.

Best Practices

To successfully implement zero downtime deployments with YARP, consider the following best practices:

Health Checks and Monitoring

Integrate health monitoring for each destination. YARP can be configured to automatically remove unhealthy destinations from the rotation.

Automated Rollbacks

Configure your deployment pipeline for automated rollback procedures in case the canary or blue-green switch indicates issues.

Incremental Traffic Shifting

With canary releases, slowly increase the percentage of traffic to the new version as confidence grows.

Consistent Configuration Management

Use configuration management tools or service discovery mechanisms to keep your YARP configurations consistent across deployments.

Secure Your Endpoints

Ensure all endpoints use HTTPS and have proper authentication and authorization mechanisms in place.

Conclusion

Achieving zero downtime deployments is a vital aspect of modern application management. YARP offers incredible flexibility to implement deployment strategies like blue-green deployments and canary releases, reducing risk and ensuring a seamless user experience. By leveraging these configurations and best practices, you can confidently deploy new versions of your applications without interruptions.

Feel free to experiment with these configurations and adjust the strategies as needed for your unique architecture and requirements. Happy deploying!

DEV Community: Leandro Veiga

Future Trends and the Role of .NET 9 in the Evolution of Software Development

Table of Contents

Introduction

Key Innovations in .NET 9

Emerging Software Development Trends

Alignment of .NET 9 with Future Trends

Practical Code Examples

URL-Safe Encoding with Base64Url

Rate Limiting with the Built-In API

Use Cases & Adoption Scenarios

Best Practices

Looking Ahead: What to Expect in .NET 10+

Conclusion

Efficient Background Jobs & Scheduled Tasks in .NET 8 with Hosted Services

Table of Contents

Introduction

Understanding Hosted Services

Creating a Simple BackgroundService

Scheduling Recurring Tasks

Using PeriodicTimer

Cron-Style Scheduling

Handling One-Off Background Jobs

Use Cases & Examples

Best Practices

Conclusion

Mastering URL‑Safe Encoding with .NET 9’s Base64Url Class: Examples & Best Practices

Table of Contents

Introduction

Why URL‑Safe Base64?

The .NET 9 Base64Url Class

Code Examples

Encoding & Decoding Strings

Working with Binary Data

Integrating with ASP.NET Core

Common Use Cases

Best Practices

Conclusion

Secure Authentication & Authorization in ASP.NET Core 9.0: A Step-by-Step Guide

Table of Contents

Introduction

What’s New in ASP.NET Core 9.0 Auth

Setting Up Authentication

JWT Bearer Authentication

Cookie Authentication

Configuring Authorization Policies

Securing Minimal APIs & MVC Endpoints

Best Practices for Secure Auth

Conclusion

Deploying .NET 8 Minimal APIs to Azure with CI/CD: A Step-by-Step Guide

Table of Contents

Introduction

Prerequisites

Preparing Your .NET 8 Minimal API Project

Setting Up CI/CD Pipelines

Using GitHub Actions

Using Azure Pipelines

Best Practices for CI/CD Deployments

Conclusion

Building RESTful APIs with .NET 8: Essential Best Practices for Performance and Security

Table of Contents

Table of Contents

Introduction

Understanding RESTful APIs in .NET 8

Setting Up Your .NET 8 API Project

Create a New Project:

Configure the Project:

Code Samples: Building a Simple RESTful API

Explanation

Best Practices for Performance

Caching

Asynchronous Programming

Rate Limiting

Profiling and Monitoring

Best Practices for Security

Authentication and Authorization

HTTPS

Data Validation

Error Handling

CORS (Cross-Origin Resource Sharing)