Updated Published 7 min read
appsettings.json and ASP.NET Core Configuration
What is appsettings.json in ASP.NET Core — appsettings.{Environment}.json, ASPNETCORE_ENVIRONMENT, user secrets, and why localappsettings.json is not a real framework file.
Blog topic
Article map for .NET + Angular architecture — Clean Architecture, modular monolith, middleware order, configuration, and Minimal APIs.
Architecture for .NET + Angular products — open the linked article for each topic. Start with Clean Architecture when boundaries are the question.
This page is the article map for .NET + Angular architecture decisions. Each linked article covers one specific design decision in depth — this index tells you which one to open.
| You want… | Open |
|---|---|
| Clean Architecture | Clean Architecture |
| Modular monolith vs microservices | Modular monolith |
| Vertical slice vs Clean Architecture | Vertical slice |
| Middleware order | Middleware order |
| appsettings / config | appsettings.json |
| Minimal APIs | Minimal APIs |
| CQRS with MediatR | CQRS and MediatR |
| Forwarded headers / reverse proxy | Forwarded headers |
Angular SPA → ASP.NET Core API → EF Core → SQL Server
↓
config, middleware, auth, validation, caching
Architecture in .NET is a set of decisions about boundaries: which code knows about which other code, how the database is accessed, how requests travel through middleware, and where the domain logic lives.
The three questions I ask first:
How many teams and how fast does the schema change? A single team shipping a healthcare app at pace benefits from a modular monolith over microservices. Distributed systems add latency, deployment complexity, and distributed transactions before the team is ready. See modular monolith vs microservices.
How complex is the domain logic? Clean Architecture and vertical slice both work — they differ in where the slicing happens. Clean Architecture organises by layer (domain → application → infrastructure). Vertical slice organises by feature — the whole request stack in one folder. On a team building one feature at a time, vertical slice reduces the "where does this go?" friction. See vertical slice vs Clean Architecture.
Where does request processing begin? Middleware runs in order. Security headers, forwarded headers, CORS, authentication, and authorisation must each run before the things that depend on them. Getting this wrong produces subtle bugs — cookies missing Secure flags, 401s that should be 403s, redirect loops behind a load balancer. See middleware order.
Calling Database.Migrate() on startup with multiple instances. Both pods race to apply the same migration. Run an idempotent SQL script in the deployment pipeline before any instance starts. See EF Core migrations in production.
Returning IEnumerable<T> from a repository backed by IQueryable. The caller's OrderBy and Take run in memory after loading every row. Declare return types that match what the underlying source actually is. See IEnumerable vs IQueryable.
Trusting X-Forwarded-For without configuring UseForwardedHeaders. Behind Azure App Service, the scheme and client IP come from headers the app must be told to trust. Omitting this configuration causes HTTPS redirect loops and logs full of the proxy IP. See forwarded headers.
Embedding identity concerns in every handler. Cross-cutting concerns — audit timestamps, soft-delete filters, current user — belong in EF Core interceptors and global query filters, not scattered across controllers. See audit log interceptors and global query filters.
Start with the Clean Architecture post if you are organising a new project. Start with Modular monolith vs microservices if you are deciding on service boundaries. If you are debugging a specific middleware or proxy problem, go directly to that article from the table above.
For security patterns that sit in the architecture layer — OWASP API Top 10, BOLA/IDOR, security headers, CSP — see the security hub.
Related: Dependency Injection · Auth & Tokens · EF Core · API Design · Caching
Clean Architecture in ASP.NET Core. This page indexes related architecture posts.
Updated Published 7 min read
What is appsettings.json in ASP.NET Core — appsettings.{Environment}.json, ASPNETCORE_ENVIRONMENT, user secrets, and why localappsettings.json is not a real framework file.
Updated Published 8 min read
Pragmatic Clean Architecture in C# / ASP.NET Core — Onion vs Clean, domain boundaries, three-project layout, and when to skip ceremony on SaaS and eCommerce APIs.
Updated Published 5 min read
Fix System.Text.Json object cycle detected in ASP.NET Core — EF navigation graphs, why ReferenceHandler.Preserve breaks Angular, and DTO projection that actually ships.
Updated Published 4 min read
ASP.NET Core middleware order for production — forwarded headers, exception handler, CORS before auth, rate limiting, and Swagger placement behind Azure and Angular SPAs.
Updated Published 5 min read
Fix InvalidOperationException Headers are read-only response has started — IExceptionHandler after WriteAsync, streaming exports, Angular CORS errors, and the HasStarted guard.
Updated Published 5 min read
Fix No XML encryptor found in ASP.NET Core Data Protection — key ring persistence for Docker, App Service scale-out, antiforgery cookies, and the XML encryptor that is not JWT signing.
6 min read
The three pillars of observability in .NET — when to use structured logs, distributed traces, and metrics. Strategy guide with Serilog and OpenTelemetry.
11 min read
Horizontal vs vertical scaling for ASP.NET Core APIs — stateless design, load balancing, and when to scale out vs scale up in production.
7 min read
Compare event sourcing and CRUD for .NET. When the audit trail and temporal queries justify event sourcing's complexity, with C# implementation patterns.
7 min read
Build event-driven systems in ASP.NET Core with MassTransit. Events vs commands, async decoupling trade-offs, and when EDA helps vs hurts.
8 min read
Understand domain services vs application services in .NET DDD. Fix the anemic domain model and know where each type of business logic belongs.
7 min read
Implement domain events in .NET aggregates and dispatch with MediatR. Domain events vs integration events, dispatch timing, and the outbox pattern.
7 min read
Cache-aside, write-through, and write-behind patterns in ASP.NET Core with Redis. When each is correct and what breaks when you pick the wrong one.
6 min read
Design idempotent APIs in ASP.NET Core to handle duplicate requests safely. Idempotency keys, database patterns, and safe at-least-once processing.
10 min read
Apply DDD in ASP.NET Core with aggregates, value objects, domain services, and application services. Know when it is worth the complexity.
7 min read
Combine CQRS and event sourcing in .NET — projections, read models, eventual consistency on the read side, and when to use one without the other.
11 min read
Implement the circuit breaker pattern in ASP.NET Core using Polly. Prevent cascade failures in microservices with open, closed, and half-open states.
8 min read
Define bounded contexts in .NET with context maps, anti-corruption layers, and the relationship between bounded contexts and microservices.
6 min read
Implement the Anti-Corruption Layer pattern in .NET to translate between bounded contexts and wrap legacy APIs. C# examples for healthcare integrations.
6 min read
Design aggregates in .NET DDD — how to size them, avoid concurrency conflicts, when to split, and implement optimistic concurrency with EF Core.
10 min read
Kafka on .NET for ASP.NET Core: adopt for replay and many consumers, commit the outbox with the row, and commit offsets after the write. Not from the controller.
11 min read
Decide .NET Aspire vs Docker Compose for local ASP.NET Core and Angular work. One laptop source of truth, not a second tutorial for the team.
15 min read
What to read on the .NET Aspire dashboard in local dev: resources, structured logs, traces, and the few metrics that move during a single session.
11 min read
A covering index for an EF Core query: which columns are keys versus INCLUDE, how IncludeProperties maps them, and how you prove the key lookup is gone.
11 min read
Capacity planning for ASP.NET Core APIs: write down peak demand, name the pool that saturates first, measure it, and do not scale the wrong tier.
12 min read
Blazor vs Angular in front of an ASP.NET Core API: Interactive Server, WebAssembly, or a separate SPA. A team decision, not a framework tutorial.
10 min read
Background report progress with SignalR in ASP.NET Core: store the job, build the file in a worker, and notify only an authorized group. Refresh uses GET.
10 min read
Reach Azure SQL and Key Vault from ASP.NET Core over private endpoints and privatelink DNS, then disable public network access on both services.
11 min read
Azure Monitor workbooks for ASP.NET Core SLOs: weight availability by itemCount, chart latency percentiles, and pass the target in as a parameter.
10 min read
Azure Functions Service Bus trigger on the .NET isolated worker: bind the queue and settle each message with complete, abandon, or dead-letter.
10 min read
Azure Event Grid with ASP.NET Core webhooks: the OPTIONS or validationResponse handshake, caller authentication, and a fast ack that stays safe on retry.
13 min read
Architecture decision records (ADR) for ASP.NET Core: one numbered file per choice, the old text left intact, and a new file when it changes.
10 min read
An anti-corruption layer in ASP.NET Core translates partner and legacy models at the edge so domain types, errors, and Angular fields stay yours.
10 min read
Angular i18n routing in ASP.NET Core: allow-listed /en and /ur prefixes, one base href model, and a path culture provider that beats a stale cookie.
12 min read
Angular @defer performance for admin dashboards: which widget waits, which trigger fires, and which ASP.NET Core call is absent on first paint.
9 min read
Angular build budgets fail CI when a production bundle exceeds maximumError. The limit counts raw emitted bytes, not the gzip size on the wire.
13 min read
Choose AKS or Azure App Service for a .NET API. Compares operations, deployment slots, and networking, without invented prices or a kubectl guide.
9 min read
OpenTelemetry in ASP.NET Core — traces, metrics, logs, ActivitySource, OTLP export, W3C traceparent, and sampling strategies.
10 min read
Multi-tenancy in ASP.NET Core beyond EF Core query filters — connection-per-tenant, tenant resolution middleware, and resource-based auth.
8 min read
gRPC vs REST in ASP.NET Core — when Protobuf streaming beats JSON/HTTP, and when REST is still the right choice for APIs.
9 min read
Getting started with .NET Aspire: the AppHost, service defaults, and adding the ASP.NET Core API and the Angular app. That is the whole scope of this page.
4 min read
When an ASP.NET Core API should use vertical slice architecture instead of Clean Architecture, and how to keep one DbContext without four projects per feature.
4 min read
The difference between .NET Framework, .NET Core, and modern .NET — what each name means and which TargetFramework to use in 2026.
Updated Published 5 min read
Master C# Nullable Reference Types (NRT): compiler static analysis, null attributes ([NotNullWhen]), C# required properties, and EF Core mappings.
Updated Published 5 min read
Configure production health checks in ASP.NET Core: isolate liveness from readiness, write custom IHealthCheck handlers, configure Kubernetes probes, and prevent restart storms.
5 min read
Fix ASP.NET Core redirecting to http, dropping the real client IP, or looping on HTTPS when it sits behind Azure App Service or YARP. The proxy is untrusted until you say so.
Updated Published 12 min read
FluentValidation in ASP.NET Core without the deprecated AspNetCore package — one ProblemDetails envelope, field errors Angular forms can bind, and validation in ASP.NET APIs.
4 min read
Semantic Kernel and LLMs in ASP.NET Core — prompts, plugins, safety, caching, and how Angular clients call AI features without leaking secrets or tokens.
Updated Published 6 min read
ASP.NET Core Minimal APIs guide — MapGet, MapGroup, DI, validation, OpenAPI, JWT auth, and when controllers still win for Angular-backed products.
Updated Published 6 min read
Set up ASP.NET Core global exception handling with ProblemDetails so Angular forms show consistent errors — middleware vs IExceptionHandler, 400 vs 500, and what not to leak.
Updated Published 9 min read
Modular monolith vs microservices for .NET — when to split C# services, module boundaries, data ownership, Angular contract stability, and migration path.
8 min read
A discovery checklist for freelance ASP.NET Core and Angular engagements — scope, auth, hosting, and handoff criteria that prevent costly surprises.
8 min read
ASP.NET Core SignalR for real-time features — hubs, Angular SignalR client, authentication, scale-out with Redis backplane.