Angular Interview Questions with ASP.NET Core: Scenario Answers

Enterprise Angular interviews almost always assume a backend — frequently ASP.NET Core with JWT, CORS, and ProblemDetails. Trivia about lifecycle hooks is cheap. Scenario fluency is not: refresh loops, errors blamed on CORS that are not CORS, guards that only hide buttons, and Signals adopted as a religion.

These scenarios come from SPA + API deliveries in healthcare and SaaS. Each answer is detailed enough to rehearse aloud.

This URL trains interview narration. For shipping code, use the implementation posts: auth guards, JWT interceptors, and CORS.

---

Scenario 1: Login redirect loop

Prompt: After a successful login API call, the Angular app flickers between /login and /home until the browser gives up. How do you debug?

Detailed answer

List likely races in order:

1. Guard runs before token is stored — navigation starts, authGuard reads null/expired token, sends user back to login, login page sees “already trying to enter,” repeats.
2. Interceptor refresh loop — API returns 401, interceptor refreshes, retries, refresh endpoint also 401, infinite cycle.
3. Redirect URL logic — returnUrl points at a guarded route that immediately rejects.

Stabilizing pattern:

• Persist access token (memory + agreed refresh strategy) before router.navigate
• Single-flight refresh (one mutex) so parallel 401s don’t stampede
• On refresh failure: clear session once, navigate to /login, stop retries

// Pseudo-order that prevents loops
await authApi.login(credentials);   // returns tokens
authStore.setTokens(tokens);        // write FIRST
await router.navigateByUrl(returnUrl || '/home');

Deep dives: Angular auth guards, JWT interceptors.

Weak answer: “Restart the API.”
Strong answer: Speaks in races and single-flight refresh.

---

Scenario 2: Console says CORS; API actually returned 500

Prompt: Chrome reports a CORS failure. Fiddler/Postman to the same URL shows HTTP 500 with a stack trace. What’s happening?

Detailed answer

Browsers apply the same-origin policy. If a cross-origin response lacks the expected Access-Control-* headers, DevTools often surfaces a CORS error even when the root cause is a server crash.

Common chain:

1. Exception before CORS headers are applied correctly
2. Mis-ordered middleware
3. Preflight OK, real request blows up without CORS headers on the error path

What to do: fix the 500 (read server logs), then confirm CORS middleware order and exception handling still emit CORS headers for the Angular origin. See CORS between Angular and ASP.NET Core.

Interview gold: “I don’t ‘fix CORS’ until I see the raw status code from a non-browser client.”

---

Scenario 3: Signals vs BehaviorSubject

Prompt: Mid-migration, a developer wants to replace every RxJS subject with Angular Signals in a month. How do you advise?

Detailed answer

Prefer Signals	Prefer RxJS / Observables
Component/feature UI state	SignalR / WebSocket streams
Derived flags with computed	Rich operator pipelines (switchMap debounce search)
Template-readable values without juggling subscriptions	Complex multi-source async composition

Signals reduce subscription boilerplate for state. They do not magically replace every async stream.

Practical hybrid: HTTP load → firstValueFrom → signal.set, or toSignal for read-only streams; keep SignalR as Observable.

See Angular Signals with ASP.NET Core APIs.

---

Scenario 4: UI hides Admin; API allows Admin

Prompt: The menu hides “Billing” for non-admins. A curious user calls POST /api/billing/refunds successfully with a non-admin JWT. Whose bug is it?

Detailed answer

The API’s bug (and a process bug if no one tested policies). Angular guards and *ngIf are UX. Security is [Authorize(Policy = "RefundBilling")] (or equivalent) on ASP.NET Core endpoints, ideally with resource checks.

Interviewers want this sentence: Never trust the SPA for authorization.

Related: RBAC policies.

---

Scenario 5: List shows stale data after save

Prompt: User edits an order, saves (200 OK), navigates to the list — still sees the old total until hard refresh.

Detailed answer

Walk the state story:

1. Did the feature store/signal update the entity after PUT?
2. Is the list using a cached HTTP response or an in-memory collection that wasn’t invalidated?
3. Are you navigating to a list component that doesn’t reload on reuse (RouteReuseStrategy / same component instance)?
4. Less common: aggressive browser caching on GET without cache headers

Fixes: update the store on success; or explicitly reload list data in ngOnInit/guard; version cache keys; set proper API cache headers for authenticated GETs.

Strong answer talks about source of truth (server) vs optimistic UI.

---

Scenario 6: Bearer token leaks to a third party

Prompt: An analytics script or absolute URL request shows Authorization: Bearer in DevTools. React?

Detailed answer

The interceptor is too greedy. Scope it to your ASP.NET Core API base URL.

export const authInterceptor: HttpInterceptorFn = (req, next) => {
  const api = environment.apiUrl;
  if (!req.url.startsWith(api)) {
    return next(req);
  }
  // attach bearer
  return next(req);
};

Also review: tokens in localStorage vs memory + httpOnly refresh cookie tradeoffs (XSS vs UX). Be honest about threat models in healthcare vs internal tools.

---

Scenario 7: Huge grid jank — blame .NET first?

Prompt: 2,000-row grid scrolls poorly. Candidate immediately asks DBA for indexes. What’s wrong with that instinct?

Detailed answer

Maybe SQL is fine and the SPA is painting too much DOM. Before blaming ASP.NET Core:

• Server-side paging/filtering (API contract)
• Virtual scroll
• trackBy
• Avoid recomputing heavy pipes each CD cycle
• OnPush / Signals for stable inputs
• Don’t bind massive arrays through multiple nested components unnecessarily

Measure both sides. Strong full-stack candidates profile Angular and inspect SQL.

---

Scenario 8: Error envelopes Angular cannot map

Prompt: Sometimes 400 returns { message: "bad" }, sometimes ModelState, sometimes a string. Forms can’t highlight fields.

Detailed answer

Standardize on ProblemDetails / validation problem details from ASP.NET Core. Map errors keys to form controls in one helper. Unhandled exceptions go through global handler — no stack traces to the browser in production.

See API validation and global exception handling.

---

Scenario 9: Environment configs and leaked secrets

Prompt: A junior puts the SQL connection string and JWT signing key in environment.prod.ts “so Angular can help debug.” Response?

Detailed answer

Frontends are public. Anything in the SPA bundle is exfiltratable. Angular gets public API URLs and maybe a public client id — never DB secrets, never signing keys, never provider AI keys. Those stay on ASP.NET Core / Key Vault.

This scenario pairs well with AI in .NET discussions about secret placement.

---

Scenario 10: Standalone components migration

Prompt: “Should we freeze features until we finish standalone migration?”

Detailed answer

Prefer incremental migration: new routes/components standalone first, shared NgModules unwrapped gradually. Freezing product delivery for purity signals poor engineering judgment unless there is a hard framework deadline. Explain tradeoffs calmly — interviewers hire judgment.

---

Rapid-fire topics (still expect crisp answers)

Topic	Senior-shaped answer
HttpClient testing	HttpTestingController, don’t hit real APIs in unit tests
Lazy routes	Load feature routes + guards; don’t download admin to every visitor
Change detection	Know when OnPush/Signals help — not slogans
Interceptor order	Multi-interceptor pipelines; auth vs logging vs error mapping
SSR	Only if you need it; most authenticated admin SPAs stay CSR

How to rehearse

1. Whiteboard the login → guard → interceptor → ASP.NET Core [Authorize] path
2. Tell a story about a CORS misdiagnosis you personally fixed
3. Explain one Signals migration without trash-talking RxJS

Related reading

• Angular + .NET integration habits
• ASP.NET Core interview scenarios
• C# async await interview questions
• Angular Signals with ASP.NET Core

Hiring for Angular + ASP.NET Core, or preparing for that loop yourself? Contact me — we can run scenario drills that match real production failures.