# Dotnet

> ASP.NET Core patterns, dependency injection, middleware, async/await, and security

- Skill: `yldgio/dotnet` (Agent Skill)
- Install (CLI): `npx skillmds add yldgio/dotnet`
- Raw SKILL.md: https://api.skillmd.com/api/skills/yldgio/dotnet/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: yldgio (https://skillmd.com/u/yldgio)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/yldgio/dotnet

---


## .NET Code Review Rules

### Security (Critical)
- **Input Validation**: Validate and sanitize all user input using whitelisted input patterns, strong type checks, and context-aware escaping (HTML/SQL/command-line contexts). Apply strict validation before any rendering or database operation
- **Comment Hygiene**: Never use HTML comments (`<!-- -->`) or template variables (e.g., `{{ }}`) to store sensitive data or security-relevant instructions. Ensure HTML comments are stripped from output before deployment
- Use `[Authorize]` attribute with policies
- Validate anti-forgery tokens for forms
- Use parameterized queries (EF Core does this by default)
- Don't log sensitive data
- Use HTTPS redirection middleware
- Store secrets in Azure Key Vault or environment variables
- Use User Secrets for local development
- Never commit secrets to source control

### Dependency Injection (Essential)
- Register services with appropriate lifetime:
  - `Singleton`: stateless, thread-safe services
  - `Scoped`: per-request services (DbContext, etc.)
  - `Transient`: lightweight, stateless services
- Avoid captive dependencies (Singleton depending on Scoped)
- Use `IOptions<T>` pattern for configuration

### Async/Await (Essential)
- Use `async`/`await` for I/O-bound operations (database, HTTP calls, file system)
- Always pass `CancellationToken` and respect it
- Avoid `.Result` or `.Wait()` (causes deadlocks)
- Use `ConfigureAwait(false)` in library code

### Async/Await (Advanced)
- Prefer `ValueTask` for hot paths that often complete synchronously

### Controllers (Essential)
- Keep controllers thin (delegate to services)
- Use `[ApiController]` attribute for automatic model validation
- Return `ActionResult<T>` for type safety
- Use `[ProducesResponseType]` for API documentation

### Controllers (Advanced)
- Implement API versioning (URL, header, or query string)
- Use consistent versioning strategy across endpoints

### Middleware
- Order matters: add middleware in correct sequence
- Authentication before Authorization
- Error handling middleware should be first (to catch all exceptions)
- Use `app.UseExceptionHandler()` for production error handling

### Model Validation
- Use Data Annotations or FluentValidation
- Validate at API boundary, not deep in business logic
- Return `400 Bad Request` for validation failures
- Include validation errors in response body

### Entity Framework Core (Essential)
- Use `AsNoTracking()` for read-only queries
- Avoid N+1 queries (use `Include()` or projection)
- Use migrations for schema changes
- Don't expose entities directly (use DTOs)
- Manage DbContext lifetime properly (scoped per request)
- Use async methods for database operations

### Advanced EF Core Patterns
- Use compiled queries for hot paths that execute frequently
- Use raw SQL via `FromSqlInterpolated`/`ExecuteSqlInterpolated` for complex queries while keeping parameters parameterized
- Define global query filters for concerns like soft deletes or multi-tenancy
- Consider splitting DbContexts by bounded context to keep models focused and reduce migration complexity

### Logging and Exception Handling
- Use structured logging with `ILogger<T>`
- Include correlation IDs for request tracing
- Log exceptions at appropriate levels (Error, Warning, Information)
- Use centralized exception handling middleware
- Don't catch exceptions unless you can handle them
- Include relevant context in log messages

### Thread Safety
- Singleton services must be thread-safe
- Avoid mutable shared state in singletons
- Use `lock`, `SemaphoreSlim`, or `ConcurrentDictionary` for shared resources
- Be cautious with static fields

### Testing
- Write unit tests for business logic
- Use in-memory providers for EF Core in tests
- Mock external dependencies with interfaces
- Test controller actions with integration tests
- Use `WebApplicationFactory` for integration testing