A hands-on guide using a real ProductAPI project — with every concept explained line by line.

What You'll Learn

All examples come from a single working project — a ProductController with a GetNetworkService helper. By the end you'll understand every line of both files.

📁 Project Structure We're Working With

ProductAPI/
├── Controllers/
│   └── ProductController.cs
├── Services/
│   └── GetNetworkService.cs
├── Options/
│   └── OpenApiOptions.cs
├── appsettings.json
└── Program.cs

Chapter 1 — HttpContext

What Is HttpContext?

Every HTTP request that arrives at your API is wrapped in an object called HttpContext. Think of it as a box that holds everything about the current web request and response — headers, cookies, the user's identity, the IP address, and more.

💡 Simple Analogy: Imagine you run a post office. Every parcel arrives with a label (headers), a sender address (IP), recipient info (URL), the parcel contents (request body), and a reply envelope (response). HttpContext is that entire parcel + reply envelope combined.

Where Does HttpContext Come From?

In ASP.NET Core, the framework creates a new HttpContext for every incoming request. Because your controller inherits from ControllerBase, it already has a property called HttpContext — no injection needed.

// ProductController.cs
[ApiController]
[Route("api/[controller]")]
public class ProductController : ControllerBase   // <-- inherits ControllerBase
{
    // ControllerBase gives you 'HttpContext' for free.
    // No constructor injection needed for HttpContext itself.
}

Reading Request Headers

Headers are key-value pairs sent by the client (browser, Postman, mobile app, etc.). Common ones include Content-Type, Authorization, and custom ones like X-Custom-Header.

// Inside Get() in ProductController.cs

var headers = HttpContext.Request.Headers;

foreach (var header in headers)
{
    Console.WriteLine($"{header.Key}: {header.Value}");

    // Check for a specific header
    if (header.Key == "X-Custom-Header")
    {
        Console.WriteLine($"Custom Header Value: {header.Value}");
    }
}

📝 Key Points:

• HttpContext.Request.Headers is a dictionary of all incoming headers.

• Keys are case-insensitive (X-Custom-Header = x-custom-header).

• Always check if a header exists before reading its value.

Writing Response Headers

You can add headers to your response — for example, a timestamp showing when the response was generated.

// Add a custom header to the HTTP response
HttpContext.Response.Headers.Add("X-Response-Time", DateTime.UtcNow.ToString("o"));

// 'o' = ISO 8601 format, e.g. 2025-06-01T12:00:00.000Z

// Log all response headers
foreach (var header in HttpContext.Response.Headers)
{
    Console.WriteLine($"{header.Key}: {header.Value}");
}

Getting the Logged-In User

HttpContext.User holds the identity of the currently authenticated user. If no authentication is configured, the user will be "Anonymous".

// Get the username of the logged-in user (or 'Anonymous' if not logged in)
var user = HttpContext.User.Identity?.Name ?? "Anonymous";

// The ?? operator means: "if null, use this fallback value"
// Identity?.Name uses ?. to safely handle the case where Identity is null

Console.WriteLine($"Session User: {user}");

Quick Reference — HttpContext Properties

Chapter 2 — IHttpContextAccessor

The Problem: Services Don't Have HttpContext

Controllers inherit ControllerBase and get HttpContext automatically. But what about a helper service class like GetNetworkService? Service classes do NOT inherit ControllerBase, so they have no direct access to HttpContext.

// ❌ This will NOT compile
public class GetNetworkService
{
    public string GetUserIP()
    {
        // ERROR: 'HttpContext' does not exist in this context
        return HttpContext.Connection.RemoteIpAddress?.ToString();
    }
}

The solution is to inject IHttpContextAccessor — an interface provided by ASP.NET Core that lets any class access the current HttpContext.

The GetNetworkService — Full Walkthrough

public class GetNetworkService
{
    // Step 1: Declare a field to store the accessor
    public readonly IHttpContextAccessor _httpContextAccessor;

    // Step 2: Receive IHttpContextAccessor via constructor injection
    public GetNetworkService(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    // Step 3: Use it — access HttpContext through the accessor
    public string GetUserIP()
    {
        return _httpContextAccessor.HttpContext
                   ?.Connection.RemoteIpAddress
                   ?.ToString() ?? "Unknown";
    }
}

Breaking Down the IP Address Line

Registering the Service — Program.cs

For dependency injection to work, you must register both IHttpContextAccessor and your service in Program.cs:

// Program.cs

var builder = WebApplication.CreateBuilder(args);

// REQUIRED: Register IHttpContextAccessor with the DI container
builder.Services.AddHttpContextAccessor();

// Register your custom service
builder.Services.AddScoped<GetNetworkService>();

builder.Services.AddControllers();
var app = builder.Build();
app.MapControllers();
app.Run();

⚠️ Common Mistake — Forgetting to Register

If you forget builder.Services.AddHttpContextAccessor(), you will get:

InvalidOperationException: Unable to resolve service for type
'Microsoft.AspNetCore.Http.IHttpContextAccessor'

Always register it before building the app.

Using the Service in the Controller

// ProductController.cs — constructor receives GetNetworkService
public class ProductController : ControllerBase
{
    private readonly GetNetworkService _myService;

    public ProductController(GetNetworkService myService)
    {
        _myService = myService;
    }

    [HttpGet("getall")]
    public ActionResult<List<Product>> Get()
    {
        // Call the service — it internally uses IHttpContextAccessor
        Console.WriteLine($"Client IP: {_myService.GetUserIP()}");
        return Ok(products);
    }
}

HttpContext vs IHttpContextAccessor — Side by Side

Chapter 3 — IConfiguration

What Is IConfiguration?

IConfiguration is ASP.NET Core's built-in way to read settings from appsettings.json (and environment variables, command-line args, etc.). You inject it into your controller or service and then read values using key paths separated by colons.

The appsettings.json File

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "AppSettings": {
    "AppName": "Products API"
  },
  "OpenApi": {
    "Title": "OpenApi",
    "Version": "v1",
    "BaseUrl": "https://api.openai.com/v1",
    "Advanced": {
      "IncludeRequestingHost": true,
      "IncludeRequestingUser": true,
      "IncludeRequestingUserAgent": true
    }
  }
}

Injecting IConfiguration

// ProductController.cs
public class ProductController : ControllerBase
{
    private readonly IConfiguration _configuration;   // declare field

    public ProductController(IConfiguration configuration)  // inject
    {
        _configuration = configuration;
    }
}

✅ No Registration Needed

Unlike GetNetworkService, IConfiguration is registered automatically by WebApplication.CreateBuilder(args) — you do NOT need to add anything to Program.cs. Just inject it and use it.

Reading Values — Key Paths with Colons

To navigate nested JSON, separate levels with a colon (:). Think of it like a file path, but with colons instead of slashes.

// Reading individual values from IConfiguration

// Reads "Products API" from AppSettings > AppName
var appName = _configuration["AppSettings:AppName"];

// Reads "OpenApi" from OpenApi > Title
var title = _configuration["OpenApi:Title"];

// Reads "v1" from OpenApi > Version
var version = _configuration["OpenApi:Version"];

// Reads "true" (as a string!) from OpenApi > Advanced > IncludeRequestingHost
var includeHost = _configuration["OpenApi:Advanced:IncludeRequestingHost"];

Iterating Over a Section

You can read an entire section at once using GetSection(). The code in our ProductController loops over all keys in the OpenApisection:

// Get all key-value pairs under the "OpenApi" section
foreach (var setting in _configuration.GetSection("OpenApi").AsEnumerable())
{
    if (!string.IsNullOrWhiteSpace(setting.Value))
    {
        Console.WriteLine($"{setting.Key}: {setting.Value}");
    }
}

// Console output:
// OpenApi:Title: OpenApi
// OpenApi:Version: v1
// OpenApi:BaseUrl: https://api.openai.com/v1
// OpenApi:Advanced:IncludeRequestingHost: True
// OpenApi:Advanced:IncludeRequestingUser: True
// OpenApi:Advanced:IncludeRequestingUserAgent: True

IConfiguration Key Path Cheatsheet

⚠️ IConfiguration Always Returns Strings

Even if your JSON value is true (boolean) or 42 (number), IConfiguration returns it as a string. To get a boolean, use:

bool flag = _configuration.GetValue<bool>("OpenApi:Advanced:IncludeRequestingHost");

This is one of the reasons IOptions<T> (Chapter 4) is often preferred.

Chapter 4 — IOptions

The Problem With Raw IConfiguration

Using IConfiguration works, but has drawbacks: string keys can have typos, values are always strings so you must manually convert types, and there is no IntelliSense. IOptions<T> solves all of these.

Step 1 — Create the Options Classes

Create a plain C# class that mirrors the shape of your JSON section. Each property name must match the JSON key exactly (case-insensitive).

// OpenApiOptions.cs
namespace ProductAPI;

public class OpenApiOptions
{
    // SectionName is a constant holding the JSON section key.
    // This avoids 'magic strings' scattered around your code.
    public const string SectionName = "OpenApi";

    // These properties map to OpenApi > Title, Version, BaseUrl in JSON
    public string Title { get; set; } = string.Empty;
    public string Version { get; set; } = string.Empty;
    public string BaseUrl { get; set; } = string.Empty;

    // Nested class maps to the 'Advanced' sub-object
    public OpenApiAdvancedOptions Advanced { get; set; } = new();
}

public class OpenApiAdvancedOptions
{
    // These are booleans — IOptions handles the conversion automatically!
    public bool IncludeRequestingHost { get; set; }
    public bool IncludeRequestingUser { get; set; }
    public bool IncludeRequestingUserAgent { get; set; }
}

Step 2 — Register in Program.cs

Tell ASP.NET Core to bind the "OpenApi" section of appsettings.json to your OpenApiOptions class:

// Program.cs
var builder = WebApplication.CreateBuilder(args);

// Bind the 'OpenApi' JSON section to OpenApiOptions class
builder.Services.Configure<OpenApiOptions>(
    builder.Configuration.GetSection(OpenApiOptions.SectionName)
);

// Note: OpenApiOptions.SectionName is just the string "OpenApi"
// Using the constant prevents typos.

builder.Services.AddControllers();
var app = builder.Build();
app.Run();

Step 3 — Inject IOptions into the Controller

// ProductController.cs
using Microsoft.Extensions.Options;     // <-- required using statement

public class ProductController : ControllerBase
{
    private readonly OpenApiOptions _openApiOptions;

    public ProductController(
        IOptions<OpenApiOptions> openApiOptions)  // <-- inject
    {
        _openApiOptions = openApiOptions.Value;   // .Value unwraps the options
    }
}

💡 Why .Value?

IOptions<T> is a wrapper. The actual OpenApiOptions object lives inside .Value. You can either call .Value each time, or store it once in the constructor (as shown above). Storing it is the recommended pattern.

Step 4 — Read the Values

// Inside Get(int id) in ProductController.cs

Console.WriteLine($"Title: {_openApiOptions.Title}");
Console.WriteLine($"Version: {_openApiOptions.Version}");
Console.WriteLine($"BaseUrl: {_openApiOptions.BaseUrl}");

// Nested advanced options — full dot-notation access
Console.WriteLine($"IncludeRequestingHost: {_openApiOptions.Advanced.IncludeRequestingHost}");
Console.WriteLine($"IncludeRequestingUser: {_openApiOptions.Advanced.IncludeRequestingUser}");
Console.WriteLine($"IncludeRequestingUserAgent: {_openApiOptions.Advanced.IncludeRequestingUserAgent}");

// Console output:
// Title: OpenApi
// Version: v1
// BaseUrl: https://api.openai.com/v1
// IncludeRequestingHost: True    <-- already a bool, no conversion!
// IncludeRequestingUser: True
// IncludeRequestingUserAgent: True

How JSON Maps to C# Class

Chapter 5 — Putting It All Together

Complete Program.cs

// Program.cs — Complete setup
using ProductAPI;

var builder = WebApplication.CreateBuilder(args);

// ── 1. IHttpContextAccessor ──────────────────────────────────────────
//    Required so GetNetworkService can access HttpContext outside a controller
builder.Services.AddHttpContextAccessor();

// ── 2. Custom Services ───────────────────────────────────────────────
//    Register GetNetworkService with Scoped lifetime
//    (new instance per HTTP request)
builder.Services.AddScoped<GetNetworkService>();

// ── 3. IOptions<T> ───────────────────────────────────────────────────
//    Bind the 'OpenApi' section of appsettings.json to OpenApiOptions
builder.Services.Configure<OpenApiOptions>(
    builder.Configuration.GetSection(OpenApiOptions.SectionName)
);

// ── 4. Standard MVC ──────────────────────────────────────────────────
builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();

var app = builder.Build();
app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();
app.Run();

Complete Controller Constructor

// ProductController.cs — constructor receives all four dependencies
public class ProductController : ControllerBase
{
    private readonly GetNetworkService _myService;       // uses IHttpContextAccessor internally
    private readonly IConfiguration _configuration;      // raw config access
    private readonly OpenApiOptions _openApiOptions;     // strongly-typed config

    public ProductController(
        GetNetworkService myService,
        IConfiguration configuration,
        IOptions<OpenApiOptions> openApiOptions)
    {
        _myService = myService;
        _configuration = configuration;
        _openApiOptions = openApiOptions.Value;
    }

    // HttpContext is available directly — no constructor injection needed.
}

How Everything Connects

HTTP Request arrives
        │
        ▼
ASP.NET Core creates HttpContext
        │
        ▼
DI Container injects:
  ├── IConfiguration          (reads appsettings.json)
  ├── IOptions<OpenApiOptions> (strongly-typed config)
  └── GetNetworkService        (uses IHttpContextAccessor internally)
        │
        ▼
ProductController runs
  ├── Uses HttpContext directly (headers, user, response)
  └── Calls _myService.GetUserIP()
              │
              ▼
        IHttpContextAccessor → HttpContext.Connection.RemoteIpAddress

Final Checklist

• [ ] Create OpenApiOptions class — match property names to JSON keys exactly

• [ ] Register IHttpContextAccessor — builder.Services.AddHttpContextAccessor()

• [ ] Register GetNetworkService — builder.Services.AddScoped<GetNetworkService>()

• [ ] Register IOptions<T> — builder.Services.Configure<OpenApiOptions>(...)

• [ ] Inject in constructor — receive IConfiguration, IOptions<T>, GetNetworkService

• [ ] Use HttpContext directly — in controller: .Request.Headers, .User.Identity, etc.

• [ ] Call .Value on IOptions<T> — store openApiOptions.Value in a field

Appendix — Quick Reference Cards

All Four Concepts at a Glance

Service Lifetime Cheatsheet

📌 Rule of Thumb: Use AddScoped for most web API services (like GetNetworkService). Use AddSingleton only for stateless, thread-safe services (e.g. caches). Use AddTransient for lightweight, stateless utilities.

Windows Setup

1. Install Visual Studio Code

2. Install .NET SDK 9+

3. Install the .NET MAUI extension in VS Code

4. Install the MAUI workload:

    dotnet workload install maui
   

5. Create a new MAUI Blazor project:

    dotnet new maui-blazor -n YourAppName
   

6. List available workloads:

    dotnet workload search
   

7. Run the app on Windows:

    dotnet run -f net9.0-windows10.0.19041.0
   

   macOS Setup

   1. Install Visual Studio Code

   2. Install .NET SDK 9+

   3. Install the .NET MAUI extension in VS Code

   4. Install Xcode from the App Store

   5. Install the MAUI workload:

       dotnet workload install maui
      

   6. Create a new MAUI Blazor project:

       dotnet new maui-blazor -n YourAppName
      

   7. List available workloads:

       dotnet workload search
      

   8. Run the app on MacCatalyst:

       dotnet build -t:Run -f net9.0-maccatalyst
      

Notes

• VS Code supports building and running, but not full drag-and-drop MAUI UI design.

• Xcode is required on macOS for MacCatalyst and iOS builds.

• Use .NET 9 or later for MAUI .net9.0-* targets.

In .NET 8, middleware configuration can stay outside Program.cs if you organize it into dedicated classes or handlers.

Let’s write a WebSocketHandler class.

📄 WebSocketHandler.cs

using System.Net.WebSockets;
using System.Text;

namespace WebSocketDemo
{
    public class WebSocketHandler
    {
        public async Task HandleAsync(WebSocket webSocket, CancellationToken cancellationToken)
        {
            Console.WriteLine("WebSocket connection established");

            var sendTask = SendPeriodicMessagesAsync(webSocket, cancellationToken);
            var receiveTask = ReceiveMessagesAsync(webSocket, cancellationToken);

            await Task.WhenAny(sendTask, receiveTask);
        }

        private async Task SendPeriodicMessagesAsync(WebSocket webSocket, CancellationToken cancellationToken)
        {
            while (!cancellationToken.IsCancellationRequested && webSocket.State == WebSocketState.Open)
            {
                var message = "Hello";
                var buffer = Encoding.UTF8.GetBytes(message);

                await webSocket.SendAsync(
                    new ArraySegment<byte>(buffer),
                    WebSocketMessageType.Text,
                    true,
                    cancellationToken
                );

                Console.WriteLine($"Sent: {message}");

                try
                {
                    await Task.Delay(TimeSpan.FromMinutes(1), cancellationToken);
                }
                catch (TaskCanceledException)
                {
                    break;
                }
            }
        }

        private async Task ReceiveMessagesAsync(WebSocket webSocket, CancellationToken cancellationToken)
        {
            var buffer = new byte[1024 * 4];

            while (!cancellationToken.IsCancellationRequested && webSocket.State == WebSocketState.Open)
            {
                var result = await webSocket.ReceiveAsync(new ArraySegment<byte>(buffer), cancellationToken);

                if (result.MessageType == WebSocketMessageType.Close)
                {
                    Console.WriteLine("Client requested close");
                    await webSocket.CloseAsync(WebSocketCloseStatus.NormalClosure, "Closing", cancellationToken);
                    break;
                }
            }
        }
    }
}

Configure WebSockets in Program.cs

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

app.UseWebSockets();

var webSocketHandler = new WebSocketHandler();

app.Map("/ws", async context =>
{
    if (context.WebSockets.IsWebSocketRequest)
    {
        var webSocket = await context.WebSockets.AcceptWebSocketAsync();
        await webSocketHandler.HandleAsync(webSocket, context.RequestAborted);
    }
    else
    {
        context.Response.StatusCode = 400;
    }
});

app.Run();

Create a Frontend to Connect
Let’s create a simple HTML file

<!DOCTYPE html>
<html>
<head>
    <title>WebSocket Client</title>
    <style>
        #socket_box {
            width: 400px;
            height: 300px;
            border: 1px solid #ccc;
            padding: 10px;
            overflow-y: auto;
            font-family: sans-serif;
        }
    </style>
</head>
<body>
    <h1>WebSocket Messages</h1>
    <div id="socket_box"></div>

    <script>
        const ws = new WebSocket('wss://localhost:5001/ws');

        ws.onopen = () => {
            console.log('WebSocket connected');
        };

        ws.onmessage = (event) => {
            const box = document.getElementById('socket_box');
            const msg = document.createElement('div');
            msg.textContent = event.data + ' at ' + new Date().toLocaleTimeString();
            box.appendChild(msg);
            box.scrollTop = box.scrollHeight;
        };

        ws.onclose = () => {
            console.log('WebSocket closed');
        };
    </script>
</body>
</html>

First, create a DTO (Data Transfer Object) that represents the product data along with the images:

public class CreateProductDto
{
    public string Name { get; set; }
    public decimal Price { get; set; }
    public string? Description { get; set; }
    public int CategoryId { get; set; }
    public List<IFormFile> Images { get; set; }
}

Here, IFormFile is used to receive uploaded files via HTTP multipart form-data.

Step 2: Create the CreateProduct API Endpoint

Now, create a POST API method to handle incoming product data and image uploads:

[HttpPost]
public async Task<ActionResult<ProductDto>> CreateProduct([FromForm] CreateProductDto createDto)
{
    var uploadedImageUrls = new List<string>();

    if (createDto.Images != null && createDto.Images.Any())
    {
        var uploadsFolder = Path.Combine(Directory.GetCurrentDirectory(), "wwwroot/uploads/products");

        if (!Directory.Exists(uploadsFolder))
        {
            Directory.CreateDirectory(uploadsFolder);
        }

        foreach (var image in createDto.Images)
        {
            var extension = Path.GetExtension(image.FileName);
            var newFileName = $"{Guid.NewGuid()}{extension}";
            var filePath = Path.Combine(uploadsFolder, newFileName);

            using (var stream = new FileStream(filePath, FileMode.Create))
            {
                await image.CopyToAsync(stream);
            }

            // Store relative URL for frontend usage
            uploadedImageUrls.Add($"/uploads/products/{newFileName}");
        }
    }

    var product = new Product
    {
        Name = createDto.Name,
        Price = createDto.Price,
        Description = createDto.Description,
        CategoryId = createDto.CategoryId,
        Images = uploadedImageUrls.Select(url => new ProductImage
        {
            ImageUrl = url
        }).ToList()
    };

    _context.Products.Add(product);
    await _context.SaveChangesAsync();

    return CreatedAtAction(nameof(GetProduct), new { id = product.Id }, product);
}

How It Works:

• [FromForm] binding is used because files must be posted as form-data, not JSON.

• The API saves each uploaded image to wwwroot/uploads/products.

• A new filename is generated using Guid.NewGuid() to avoid name collisions.

• The server stores the relative URL (like /uploads/products/xyz.jpg) for each image.

• All product details (including images) are finally saved into the database.

Important Tips

• ✅ Create wwwroot/uploads/products folder manually or ensure it's auto-created in code (we handle it above).

• ✅ Configure Startup.cs / Program.cs (depending on your .NET version) to serve static files:

    app.UseStaticFiles();
  

• ✅ Limit the allowed file types (e.g., only .jpg, .png) and size if needed for security.

• ✅ Handle errors gracefully (e.g., invalid files, large uploads).

Before writing any code, you need to set up a project in the Google Cloud Console:

1. Go to the Google Cloud Console

2. Create a new project or select an existing one

3. Navigate to "APIs & Services" > "Credentials"

4. Click "Create Credentials" and select "OAuth client ID"

5. Configure the OAuth consent screen with your application details

6. For application type, select "Web application"

7. Add authorized JavaScript origins (e.g., http://localhost:7276 for development)

8. Add authorized redirect URIs

9. Create the client ID and note your Client ID and Client Secret

2. Configuring Your ASP.NET Core Application

Add the necessary NuGet packages to your project:

dotnet add package Google.Apis.Auth
dotnet add package Microsoft.AspNetCore.Identity
dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

Update your appsettings.json file with the Google OAuth configuration:

{
  "Google": {
    "ClientId": "YOUR_GOOGLE_CLIENT_ID",
    "ClientSecret": "YOUR_GOOGLE_CLIENT_SECRET"
  },
  "JwtConfig": {
    "Secret": "YOUR_SECURE_JWT_SECRET_KEY",
    "Issuer": "YourAppName",
    "Audience": "YourAppUsers",
    "ExpiryInMinutes": 60
  }
}

3. The Token Service Implementation

The token service is responsible for generating JWT tokens for authenticated users:

public class TokenService
{
    private readonly IConfiguration _configuration;
    private readonly UserManager<ApplicationUser> _userManager;

    public TokenService(IConfiguration configuration, UserManager<ApplicationUser> userManager)
    {
        _configuration = configuration;
        _userManager = userManager;
    }

    public async Task<string> GenerateToken(ApplicationUser user)
    {
        var jwtTokenHandler = new JwtSecurityTokenHandler();
        var key = Encoding.ASCII.GetBytes(_configuration["JwtConfig:Secret"]);
        var roles = await _userManager.GetRolesAsync(user);

        // Create claims for the token
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.NameIdentifier, user.Id),
            new Claim(JwtRegisteredClaimNames.Sub, user.UserName),
            new Claim(JwtRegisteredClaimNames.Email, user.Email),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
        };

        // Add role claims
        foreach (var role in roles)
        {
            claims.Add(new Claim(ClaimTypes.Role, role));
        }

        // Create token descriptor
        var now = DateTime.UtcNow;
        var expires = now.AddMinutes(Convert.ToDouble(_configuration["JwtConfig:ExpiryInMinutes"] ?? "60"));

        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(claims),
            NotBefore = now,
            Expires = expires,
            SigningCredentials = new SigningCredentials(
                new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature),
            Issuer = _configuration["JwtConfig:Issuer"] ?? "DefaultIssuer",
            Audience = _configuration["JwtConfig:Audience"] ?? "DefaultAudience"
        };

        var token = jwtTokenHandler.CreateToken(tokenDescriptor);
        return jwtTokenHandler.WriteToken(token);
    }
}

4. The Authentication Controller

Next, implement the controller that handles Google authentication:

[Route("api/[controller]")]
[ApiController]
public class AuthController : ControllerBase
{
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly RoleManager<IdentityRole> _roleManager;
    private readonly IConfiguration _configuration;
    private readonly TokenService _tokenService;

    public AuthController(
        UserManager<ApplicationUser> userManager,
        RoleManager<IdentityRole> roleManager,
        IConfiguration configuration,
        TokenService tokenService)
    {
        _userManager = userManager;
        _roleManager = roleManager;
        _configuration = configuration;
        _tokenService = tokenService;
    }

    [HttpPost("google-login")]
    public async Task<IActionResult> GoogleLogin([FromBody] GoogleLoginDTO model)
    {
        // Validate request
        if (string.IsNullOrEmpty(model.IdToken))
        {
            return BadRequest(new AuthResponseDto
            {
                IsSuccess = false,
                Message = "Google token is required"
            });
        }

        try
        {
            // Validate Google token
            var payload = await GoogleJsonWebSignature.ValidateAsync(
                model.IdToken,
                new GoogleJsonWebSignature.ValidationSettings
                {
                    Audience = new[] { _configuration["Google:ClientId"] }
                });

            // Check if user exists
            var user = await _userManager.FindByEmailAsync(payload.Email);
            if (user == null)
            {
                // Create new user if doesn't exist
                user = new ApplicationUser
                {
                    UserName = payload.Email,
                    Email = payload.Email,
                    EmailConfirmed = true,
                    SecurityStamp = Guid.NewGuid().ToString()
                };
                var createResult = await _userManager.CreateAsync(user);
                if (!createResult.Succeeded)
                {
                    return BadRequest(new AuthResponseDto
                    {
                        IsSuccess = false,
                        Message = "User creation failed: " +
                            string.Join(", ", createResult.Errors.Select(e => e.Description))
                    });
                }

                // Ensure Customer role exists
                if (!await _roleManager.RoleExistsAsync("Customer"))
                {
                    await _roleManager.CreateAsync(new IdentityRole("Customer"));
                }

                // Add to Customer role
                var roleResult = await _userManager.AddToRoleAsync(user, "Customer");
                if (!roleResult.Succeeded)
                {
                    return BadRequest(new AuthResponseDto
                    {
                        IsSuccess = false,
                        Message = "Failed to assign role: " +
                            string.Join(", ", roleResult.Errors.Select(e => e.Description))
                    });
                }
            }

            // Generate JWT token
            var token = await _tokenService.GenerateToken(user);
            var roles = await _userManager.GetRolesAsync(user);

            return Ok(new AuthResponseDto
            {
                IsSuccess = true,
                Token = token,
                UserName = user.UserName,
                Email = user.Email,
                Message = "Google login successful",
                Roles = roles.ToList()
            });
        }
        catch (Exception ex)
        {
            return BadRequest(new AuthResponseDto
            {
                IsSuccess = false,
                Message = $"Authentication failed: {ex.Message}"
            });
        }
    }
}

5. Data Transfer Objects (DTOs)

Create the necessary DTOs for handling requests and responses:

public class GoogleLoginDTO
{
    public string IdToken { get; set; }
}

public class AuthResponseDto
{
    public bool IsSuccess { get; set; }
    public string Message { get; set; }
    public string Token { get; set; }
    public string UserName { get; set; }
    public string Email { get; set; }
    public List<string> Roles { get; set; }
}

6. Frontend Implementation

Here's a simple HTML page with JavaScript to implement Google Sign-In:

Create a wwwroot folder and root and add index.html

html<!DOCTYPE html>
<html>
<head>
    <title>Google OAuth</title>
    <script src="https://accounts.google.com/gsi/client" async defer></script>
</head>
<body>
    <h1>Login with Google</h1>
    <div id="g_id_onload"
         data-client_id="YOUR_GOOGLE_CLIENT_ID"
         data-callback="handleGoogleResponse"
         data-auto_prompt="false">
    </div>
    <div class="g_id_signin"
         data-type="standard"
         data-size="large"
         data-theme="outline"
         data-text="sign_in_with"
         data-shape="rectangular"
         data-logo_alignment="left">
    </div>
    <script>
        function handleGoogleResponse(response) {
            console.log("Google response received");
            // Send the ID token to your backend
            fetch('/api/auth/google-login', {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                },
                body: JSON.stringify({ idToken: response.credential })
            })
            .then(response => response.json())
            .then(data => {
                console.log('Success:', data);
                if (data.isSuccess) {
                    // Store the JWT token
                    localStorage.setItem('jwt', data.token);
                    // Redirect or update UI as needed
                    alert('Login successful!');
                } else {
                    alert('Login failed: ' + data.message);
                }
            })
            .catch(error => {
                console.error('Error:', error);
                alert('Login failed');
            });
        }
    </script>
</body>
</html>

To use static files on your project add app.UseStaticFiles(); before app.run();
Github: https://github.com/sudipbhr/asp.net-web-api-auth

What We'll Build

By the end of this tutorial, you'll have:

1. A complete authentication system with registration and login endpoints

2. JWT token generation and validation

3. Role-based authorization

4. Protected API endpoints

Prerequisites

• .NET 6.0 or higher

• Basic understanding of ASP.NET Core

• PostgreSQL database (or you can adapt to another DB provider)

• Visual Studio or VS Code

Project Setup

Let's start by setting up our project structure. We'll need the following components:

1. Models for authentication

2. DbContext for Entity Framework Core

3. Token generation service

4. Authentication controllers

5. Protected API endpoints

Required Packages

Install following required packages

1. Microsoft.EntityFrameworkCore.Tools

2. Microsoft.AspNetCore.Identity

3. Microsoft.AspNetCore.Authentication.JwtBearer

Step 1: Setting Up the User Model and DTOs

First, let's create our user model by extending the IdentityUser class from ASP.NET Core Identity:
Models/ApplicationUser.cs

// ApplicationUser.cs
using Microsoft.AspNetCore.Identity;

namespace Ecommerce.Models
{
    public class ApplicationUser: IdentityUser
    {
        public string MobileNumber { get; set; }
        public string Address { get; set; }
    }
}

Run migrations and update database:

Go to package manager console :
1. add-migration “updated user module”
2. update-database

Next, we'll need DTOs (Data Transfer Objects) for registration and login:
Create a Folder name DTOs/Auth/

//  DTOs/Auth/RegisterDto.cs
public class RegisterDto
{
    public string Email { get; set; }
    public string UserName { get; set; }
    public string Password { get; set; }
    public string MobileNumber { get; set; }
    public string Address { get; set; }
}

//  DTOs/Auth/LoginDto.cs
public class LoginDto
{
    public string UserName { get; set; }
    public string Password { get; set; }
}

//  DTOs/Auth/AuthResponseDto.cs
public class AuthResponseDto
{
    public bool IsSuccess { get; set; }
    public string Message { get; set; }
    public string Token { get; set; }
    public string UserName { get; set; }
    public string Email { get; set; }
    public List<string> Roles { get; set; }
}

Step 2: Setting Up the Database Context

Next, we need to create our database context:

// Data/ApplicationDbContext.cs
using Ecommerce.Models;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;

namespace Ecommerce.Data
{
    public class ApplicationDbContext : IdentityDbContext<ApplicationUser>
    {
        public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options)
            : base(options)
        {
        }
    }
}

Step 3: Creating a Token Service

The most important part of JWT authentication is token generation. Let's create a service that will handle this:

// Services/TokenService.cs
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Ecommerce.Models;
using Microsoft.AspNetCore.Identity;
using Microsoft.Extensions.Configuration;
using Microsoft.IdentityModel.Tokens;

namespace Ecommerce.Services
{
    public class TokenService
    {
        private readonly IConfiguration _configuration;
        private readonly UserManager<ApplicationUser> _userManager;

        public TokenService(IConfiguration configuration, UserManager<ApplicationUser> userManager)
        {
            _configuration = configuration;
            _userManager = userManager;
        }

        public async Task<string> GenerateToken(ApplicationUser user)
        {
            var jwtTokenHandler = new JwtSecurityTokenHandler();
            var key = Encoding.ASCII.GetBytes(_configuration["JwtConfig:Secret"]);

            var roles = await _userManager.GetRolesAsync(user);
            var claims = new List<Claim>
            {
                new Claim(ClaimTypes.NameIdentifier, user.Id),
                new Claim(JwtRegisteredClaimNames.Sub, user.UserName),
                new Claim(JwtRegisteredClaimNames.Email, user.Email),
                new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
            };

            // Add role claims
            foreach (var role in roles)
            {
                claims.Add(new Claim(ClaimTypes.Role, role));
            }

            // Set defaults if config values are missing
            var issuer = _configuration["JwtConfig:Issuer"] ?? "DefaultIssuer";
            var audience = _configuration["JwtConfig:Audience"] ?? "DefaultAudience";
            var expiryMinutesStr = _configuration["JwtConfig:ExpiryInMinutes"];
            var expiryMinutes = string.IsNullOrEmpty(expiryMinutesStr) ? 60 : Convert.ToDouble(expiryMinutesStr);

            // Important: Set the NotBefore time to now and Expires to a future time
            var now = DateTime.UtcNow;
            var expires = now.AddMinutes(expiryMinutes);

            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(claims),
                NotBefore = now,
                Expires = expires,
                SigningCredentials = new SigningCredentials(
                    new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature),
                Issuer = issuer,
                Audience = audience
            };

            var token = jwtTokenHandler.CreateToken(tokenDescriptor);
            return jwtTokenHandler.WriteToken(token);
        }
    }
}

Step 4: Creating the Authentication Controller

Now, let's create the controller that will handle registration and login:

// Controllers/AuthController.cs
using Ecommerce.Models;
using Ecommerce.Services;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;

namespace Ecommerce.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class AuthController : ControllerBase
    {
        private readonly UserManager<ApplicationUser> _userManager;
        private readonly SignInManager<ApplicationUser> _signInManager;
        private readonly RoleManager<IdentityRole> _roleManager;
        private readonly TokenService _tokenService;

        public AuthController(
            UserManager<ApplicationUser> userManager,
            SignInManager<ApplicationUser> signInManager,
            RoleManager<IdentityRole> roleManager,
            TokenService tokenService)
        {
            _userManager = userManager;
            _signInManager = signInManager;
            _roleManager = roleManager;
            _tokenService = tokenService;
        }

        [HttpPost("register")]
        public async Task<IActionResult> Register([FromBody] RegisterDto model)
        {
            if (!ModelState.IsValid)
            {
                return BadRequest(new AuthResponseDto
                {
                    IsSuccess = false,
                    Message = "Invalid request"
                });
            }

            var userExists = await _userManager.FindByNameAsync(model.UserName);
            if (userExists != null)
            {
                return BadRequest(new AuthResponseDto
                {
                    IsSuccess = false,
                    Message = "User already exists"
                });
            }

            var user = new ApplicationUser
            {
                UserName = model.UserName,
                Email = model.Email,
                MobileNumber = model.MobileNumber,
                Address = model.Address,
                SecurityStamp = Guid.NewGuid().ToString()
            };

            var result = await _userManager.CreateAsync(user, model.Password);
            if (!result.Succeeded)
            {
                return BadRequest(new AuthResponseDto
                {
                    IsSuccess = false,
                    Message = "User creation failed: " + string.Join(", ", result.Errors.Select(e => e.Description))
                });
            }

            // Ensure the "Customer" role exists, create it if it doesn't
            if (!await _roleManager.RoleExistsAsync("Customer"))
            {
                await _roleManager.CreateAsync(new IdentityRole("Customer"));
            }

            // Add user to Customer role
            await _userManager.AddToRoleAsync(user, "Customer");

            return Ok(new AuthResponseDto
            {
                IsSuccess = true,
                Message = "User created successfully"
            });
        }

        [HttpPost("login")]
        public async Task<IActionResult> Login([FromBody] LoginDto model)
        {
            if (!ModelState.IsValid)
            {
                return BadRequest(new AuthResponseDto
                {
                    IsSuccess = false,
                    Message = "Invalid request"
                });
            }

            var user = await _userManager.FindByNameAsync(model.UserName);
            if (user == null)
            {
                return Unauthorized(new AuthResponseDto
                {
                    IsSuccess = false,
                    Message = "Invalid username or password"
                });
            }

            var result = await _signInManager.CheckPasswordSignInAsync(user, model.Password, false);
            if (!result.Succeeded)
            {
                return Unauthorized(new AuthResponseDto
                {
                    IsSuccess = false,
                    Message = "Invalid username or password"
                });
            }

            var token = await _tokenService.GenerateToken(user);
            var roles = await _userManager.GetRolesAsync(user);

            return Ok(new AuthResponseDto
            {
                IsSuccess = true,
                Token = token,
                UserName = user.UserName,
                Email = user.Email,
                Message = "Login successful",
                Roles = roles.ToList()
            });
        }
    }
}

Step 5: Creating Protected Endpoints

Finally, let's create some protected endpoints that will require authentication and specific roles:

// Controllers/ProductsController.cs
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace Ecommerce.Controllers
{
    [Authorize]
    [Route("api/[controller]")]
    [ApiController]
    public class ProductsController : ControllerBase
    {
        [HttpGet]
        public IActionResult Get()
        {
            return Ok(new { Message = "This is a protected endpoint" });
        }

        [Authorize(Roles = "Customer")]
        [HttpGet("customer")]
        public IActionResult GetCustomer()
        {
            return Ok(new { Message = "This endpoint is only accessible to users with the Customer role" });
        }
    }
}

Step 6: Configuring the Application

Now, let's configure our application in the Program.cs file:

// Program.cs
using Microsoft.EntityFrameworkCore;
using Ecommerce.Models;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Ecommerce.Data;
using Microsoft.IdentityModel.Tokens;
using System.Text;
using Ecommerce.Services;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddDbContext<ApplicationDbContext>(
    options =>
    options.UseNpgsql(
        builder.Configuration.GetConnectionString("DefaultConnection")));

builder.Services.AddIdentity<ApplicationUser, IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders();
builder.Services.AddScoped<TokenService>();

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.SaveToken = true;
    options.RequireHttpsMetadata = false;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = builder.Configuration["JwtConfig:Issuer"],
        ValidAudience = builder.Configuration["JwtConfig:Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["JwtConfig:Secret"]))
    };
});

builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

app.UseAuthentication(); // Don't forget this!
app.UseAuthorization();

app.MapControllers();

// Initialize roles
using (var scope = app.Services.CreateScope())
{
    var roleManager = scope.ServiceProvider.GetRequiredService<RoleManager<IdentityRole>>();

    // Ensure Customer role exists
    if (!await roleManager.RoleExistsAsync("Customer"))
    {
        await roleManager.CreateAsync(new IdentityRole("Customer"));
    }
}

app.Run();

Step 7: Configure JWT Settings in appsettings.json

Don't forget to add JWT configuration to your appsettings.json file:

{
  "ConnectionStrings": {
    "DefaultConnection": "Host=localhost;Database=EcommerceDb;Username=postgres;Password=yourpassword"
  },
  "JwtConfig": {
    "Secret": "YourSuperSecretKeyWithAtLeast32Characters",
    "Issuer": "YourApiDomain.com",
    "Audience": "YourFrontendDomain.com",
    "ExpiryInMinutes": 60
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

Security Considerations

When implementing JWT authentication, keep the following security considerations in mind:

1. Secret Key Protection: Your JWT secret key should be at least 32 characters long and kept secure. Consider using Azure Key Vault or similar services for production.

2. Token Expiration: Always set a reasonable expiration time for your tokens. In our example, we set it to 60 minutes.

3. HTTPS: Always use HTTPS in production to encrypt JWT tokens in transit.

4. Claim Validation: Validate all claims, including issuer and audience.

5. Refresh Tokens: For longer sessions, implement refresh tokens instead of extending JWT token expiration.

Testing the Authentication Flow

You can test your authentication system using a tool like Postman:

1. Register a new user via the /api/Auth/register endpoint:

{
  "email": "user@example.com",
  "userName": "testuser",
  "password": "StrongPassword123!",
  "mobileNumber": "1234567890",
  "address": "123 Test Street"
}

2. Login via the /api/Auth/login endpoint:

{
  "userName": "testuser",
  "password": "StrongPassword123!"
}

3. Copy the token from the response and use it in the Authorization header (Bearer token) to access protected endpoints like /api/Products.

   Github : https://github.com/sudipbhr/asp.net-web-api-auth

Conclusion

In this tutorial, we've implemented a complete JWT authentication system in ASP.NET Core. We've covered user registration, login, token generation, and role-based authorization. This system is a solid foundation for securing your Web API and can be extended with features like refresh tokens, email confirmation, and more advanced authorization policies.

Scenario:

We have a system that processes orders. When an order is placed:

1. A Payment needs to be processed.

2. A Confirmation Email should be sent to the customer.

3. A Logging service logs each step of the order process.

We want to keep these services decoupled so we can easily swap them out or mock them for testing. This is where Dependency Injection (DI) comes into play.

1. Define Interfaces and Implementations

We'll start by defining the services that our order processing system will depend on.

Payment Service

public interface IPaymentService
{
    bool ProcessPayment(Order order);
}

public class PaymentService : IPaymentService
{
    public bool ProcessPayment(Order order)
    {
        // Imagine calling an external payment provider API here.
        Console.WriteLine($"Processing payment for Order ID: {order.OrderId}");
        return true;  // Payment success
    }
}

Email Service

public interface IEmailService
{
    void SendOrderConfirmationEmail(Order order);
}

public class EmailService : IEmailService
{
    public void SendOrderConfirmationEmail(Order order)
    {
        // Imagine sending an email here
        Console.WriteLine($"Sending confirmation email to {order.CustomerEmail} for Order ID: {order.OrderId}");
    }
}

Logging Service

public interface ILoggingService
{
    void Log(string message);
}

public class LoggingService : ILoggingService
{
    public void Log(string message)
    {
        // Imagine writing logs to a file, database, or external service.
        Console.WriteLine($"Log: {message}");
    }
}

2. Create the Order Model

We'll create a simple Order model to pass data through the services.

public class Order
{
    public int OrderId { get; set; }
    public string CustomerEmail { get; set; }
    public decimal TotalAmount { get; set; }
}

3. Define the Order Processor

This is the main service that coordinates the different operations (payment, email, logging) when an order is placed.

public class OrderProcessor
{
    private readonly IPaymentService _paymentService;
    private readonly IEmailService _emailService;
    private readonly ILoggingService _loggingService;

    // Constructor Injection
    public OrderProcessor(
        IPaymentService paymentService,
        IEmailService emailService,
        ILoggingService loggingService)
    {
        _paymentService = paymentService;
        _emailService = emailService;
        _loggingService = loggingService;
    }

    public void ProcessOrder(Order order)
    {
        // Log the order processing
        _loggingService.Log($"Started processing Order ID: {order.OrderId}");

        // Process payment
        var paymentSuccess = _paymentService.ProcessPayment(order);
        if (paymentSuccess)
        {
            _loggingService.Log($"Payment successful for Order ID: {order.OrderId}");

            // Send email confirmation
            _emailService.SendOrderConfirmationEmail(order);
            _loggingService.Log($"Confirmation email sent for Order ID: {order.OrderId}");
        }
        else
        {
            _loggingService.Log($"Payment failed for Order ID: {order.OrderId}");
        }

        // Final log
        _loggingService.Log($"Finished processing Order ID: {order.OrderId}");
    }
}

4. Register Services in the DI Container

Now, we need to register our services (PaymentService, EmailService, LoggingService) in the DI container so that they can be injected into the OrderProcessor.

In Startup.cs (for ASP.NET Core 3.x or .NET 5):

public void ConfigureServices(IServiceCollection services)
{
    // Register services with DI container
    services.AddTransient<IPaymentService, PaymentService>();  // Transient - new instance each time
    services.AddTransient<IEmailService, EmailService>();      // Transient - new instance each time
    services.AddTransient<ILoggingService, LoggingService>();  // Transient - new instance each time

    // Register OrderProcessor service
    services.AddTransient<OrderProcessor>();

    services.AddControllers();
}

In Program.cs (for ASP.NET Core 6+):

var builder = WebApplication.CreateBuilder(args);

// Register services with DI container
builder.Services.AddTransient<IPaymentService, PaymentService>();
builder.Services.AddTransient<IEmailService, EmailService>();
builder.Services.AddTransient<ILoggingService, LoggingService>();
builder.Services.AddTransient<OrderProcessor>();

builder.Services.AddControllers();

var app = builder.Build();
app.MapControllers();
app.Run();

5. Inject OrderProcessor into a Controller

Now, let's use constructor injection to inject the OrderProcessor into a controller where we handle HTTP requests.

[ApiController]
[Route("api/[controller]")]
public class OrdersController : ControllerBase
{
    private readonly OrderProcessor _orderProcessor;

    // Constructor Injection
    public OrdersController(OrderProcessor orderProcessor)
    {
        _orderProcessor = orderProcessor;
    }

    [HttpPost]
    [Route("process")]
    public IActionResult ProcessOrder([FromBody] Order order)
    {
        // Use OrderProcessor to handle the order
        _orderProcessor.ProcessOrder(order);

        return Ok("Order processed successfully!");
    }
}

6. Example Request

Now, when you make a POST request to the API endpoint /api/orders/process with an order body:

{
  "OrderId": 1,
  "CustomerEmail": "customer@example.com",
  "TotalAmount": 99.99
}

The system will:

1. Log the order processing.

2. Process the payment.

3. Send a confirmation email.

4. Log the result at each step.

7. How DI Works in This Example

• The OrderProcessor depends on three services: IPaymentService, IEmailService, and ILoggingService.

• These dependencies are injected by ASP.NET Core's DI container via constructor injection.

• The DI container automatically resolves and provides the appropriate instances of PaymentService, EmailService, and LoggingService when the OrderProcessor is instantiated.

• This means we can easily swap out the implementations of these services without modifying the OrderProcessor class. For example, we could replace PaymentService with a mock version for testing or swap in a new payment provider.

8. Benefits of Dependency Injection

1. Loose Coupling: The OrderProcessor is not tightly coupled to specific implementations of PaymentService, EmailService, or LoggingService. You can swap them out as needed.

2. Testability: It’s easy to mock or replace services in tests. For example, in unit tests, you can mock IPaymentService and IEmailService.

3. Maintainability: Adding new features or services doesn’t require changes to the core logic (e.g., adding a new ShippingService).

4. Configuration Management: You can configure services in one central location (DI container), which makes managing complex dependencies easier.

9. Conclusion

This real-life example of DI in ASP.NET Core demonstrates how you can build a loosely-coupled, maintainable, and testable application. By injecting dependencies like PaymentService, EmailService, and LoggingService into the OrderProcessor, you ensure that the application is flexible and scalable, while also promoting good software engineering practices like separation of concerns and single responsibility.

In this guide, we'll explore how to build a complete Book Records API using ASP.NET Core and implement data validation using annotations. We'll cover everything from creating a new project to implementing CRUD operations with proper validation.

Understanding ASP.NET Core Web API

ASP.NET Core Web API is a framework for building HTTP services that can be accessed from any client, including browsers and mobile devices. It's built on the ASP.NET Core platform and provides a more lightweight and modular approach compared to traditional ASP.NET.

Key features include:

• Cross-platform compatibility (Windows, macOS, Linux)

• High-performance architecture

• Built-in dependency injection

• Simplified routing using attributes

• Content negotiation and formatting

• Model binding and validation

Data Annotations in .NET

Data annotations are attributes that you can apply to model classes and properties to:

• Enforce validation rules

• Specify display formats

• Define relationships between models

• Configure how model binding behaves

These annotations reside in the System.ComponentModel.DataAnnotations namespace and provide a declarative way to implement validation logic without writing extensive code.

Common annotations include:

• [Required]: Ensures a property has a value

• [StringLength]: Limits the length of a string

• [Range]: Specifies minimum and maximum values for numeric types

• [EmailAddress]: Validates email format

• [RegularExpression]: Validates against a regex pattern

Step-by-Step Guide to Create a Book API

1. Set Up Your Development Environment

First, ensure you have the following installed:

• .NET 6.0 SDK or later

• An IDE (Visual Studio, VS Code with C# extension, or JetBrains Rider)

2. Create a New ASP.NET Core Web API Project

Using Visual Studio:

1. Open Visual Studio

2. Select "Create a new project"

3. Choose "ASP.NET Core Web API"

4. Name your project (e.g., "BookRecordAPI")

5. Select .NET 6.0 or later as the target framework

6. Uncheck "Use controllers" if you prefer minimal API style (for this guide, we'll use controllers)

7. Click "Create"

dotnet new webapi -n BookRecordAPI
cd BookRecordAPI

3. Project Structure

After creating the project, you should have a folder structure similar to:

BookRecordAPI/
├── Controllers/
├── Properties/
├── appsettings.json
├── appsettings.Development.json
├── Program.cs
└── BookRecordAPI.csproj

4. Create the Model Folder and Book Class

Create a new folder called "Models" and add a Book class:

using System.ComponentModel.DataAnnotations;

namespace BookRecordAPI.Models
{
    public class Book
    {
        public int Id { get; set; }

        [Required]
        [StringLength(200)]
        public string Title { get; set; }

        [Required]
        [StringLength(100)]
        public string Author { get; set; }

        [Required]
        [StringLength(50)]
        public string Genre { get; set; }

        [Range(1000, 2100, ErrorMessage = "Published Year must be between 1000 and 2100.")]
        public int PublishedYear { get; set; }
    }
}

Implementing the Book Model with Annotations

Let's analyze each annotation in our Book model:

1. [Required]

[Required]
public string Title { get; set; }

The [Required] attribute ensures that the property must have a value. For string properties, it verifies that the value isn't null or an empty string. When model validation occurs, ASP.NET Core will automatically check this constraint.

2. [StringLength]

[StringLength(200)]
public string Title { get; set; }

The [StringLength] attribute restricts the length of a string property. It accepts parameters for maximum length and optionally minimum length. In our example:

• Title has a maximum length of 200 characters

• Author has a maximum length of 100 characters

• Genre has a maximum length of 50 characters

3. [Range]

[Range(1000, 2100, ErrorMessage = "Published Year must be between 1000 and 2100.")]
public int PublishedYear { get; set; }

The [Range] attribute specifies minimum and maximum values for numeric properties. In this case, we're ensuring that the PublishedYear is between 1000 and 2100.

The ErrorMessage parameter allows you to customize the validation error message that will be returned if the validation fails.

Creating API Controllers and Routes

Now, let's create a controller to handle HTTP requests for our Book API:

using Microsoft.AspNetCore.Mvc;
using BookRecordAPI.Models;
using System.Collections.Generic;
using System.Linq;

namespace BookRecordAPI.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class BooksController : ControllerBase
    {
        private static List<Book> books = new List<Book>
        {
            new Book { Id = 1, Title = "1984", Author = "George Orwell", Genre = "Dystopian", PublishedYear = 1949 },
            new Book { Id = 2, Title = "To Kill a Mockingbird", Author = "Harper Lee", Genre = "Fiction", PublishedYear = 1960 }
        };

        // GET: api/books
        [HttpGet]
        public ActionResult<IEnumerable<Book>> GetBooks()
        {
            return Ok(books);
        }

        // GET: api/books/{id}
        [HttpGet("{id}")]
        public ActionResult<Book> GetBook(int id)
        {
            var book = books.FirstOrDefault(b => b.Id == id);
            if (book == null)
                return NotFound(new { message = "Book not found" });

            return Ok(book);
        }

        // POST: api/books
        [HttpPost]
        public ActionResult<Book> AddBook([FromBody] Book book)
        {
            if (books.Any(b => b.Id == book.Id))
                return BadRequest(new { message = "Book with this ID already exists" });

            books.Add(book);
            return CreatedAtAction(nameof(GetBook), new { id = book.Id }, book);
        }

        // PUT: api/books/{id}
        [HttpPut("{id}")]
        public ActionResult UpdateBook(int id, [FromBody] Book updatedBook)
        {
            var book = books.FirstOrDefault(b => b.Id == id);
            if (book == null)
                return NotFound(new { message = "Book not found" });

            book.Title = updatedBook.Title;
            book.Author = updatedBook.Author;
            book.Genre = updatedBook.Genre;
            book.PublishedYear = updatedBook.PublishedYear;

            return NoContent();
        }

        // PATCH: api/books/{id}
        [HttpPatch("{id}")]
        public ActionResult PatchBook(int id, [FromBody] Dictionary<string, object> updates)
        {
            var book = books.FirstOrDefault(b => b.Id == id);
            if (book == null)
                return NotFound(new { message = "Book not found" });

            foreach (var key in updates.Keys)
            {
                switch (key.ToLower())
                {
                    case "title":
                        book.Title = updates[key].ToString();
                        break;
                    case "author":
                        book.Author = updates[key].ToString();
                        break;
                    case "genre":
                        book.Genre = updates[key].ToString();
                        break;
                    case "publishedyear":
                        if (int.TryParse(updates[key].ToString(), out int year))
                            book.PublishedYear = year;
                        break;
                }
            }
            return NoContent();
        }

        // DELETE: api/books/{id}
        [HttpDelete("{id}")]
        public ActionResult DeleteBook(int id)
        {
            var book = books.FirstOrDefault(b => b.Id == id);
            if (book == null)
                return NotFound(new { message = "Book not found" });

            books.Remove(book);
            return NoContent();
        }
    }
}

Key Controller Components Explained

1. Controller Attributes

[Route("api/[controller]")]
[ApiController]

• [Route("api/[controller]")]: Defines the route template for the controller. [controller] is replaced with the controller name (minus the "Controller" suffix), resulting in /api/books.

• [ApiController]: Adds API-specific behaviors, including automatic model validation and binding source parameter inference.

2. HTTP Method Attributes

[HttpGet]
[HttpGet("{id}")]
[HttpPost]
[HttpPut("{id}")]
[HttpPatch("{id}")]
[HttpDelete("{id}")]

These attributes map HTTP verbs to controller actions and define route templates. For example, [HttpGet("{id}")] maps HTTP GET requests to /api/books/{id} to the GetBook method.

3. Model Binding and Validation

public ActionResult<Book> AddBook([FromBody] Book book)

• [FromBody]: Indicates that the parameter should be bound from the request body.

• When a request comes in, ASP.NET Core automatically:

  1. Deserializes the JSON request body to a Book object

  2. Validates the object against the data annotations

  3. Populates ModelState with any validation errors

4. Response Types

return Ok(books);
return NotFound(new { message = "Book not found" });
return BadRequest(new { message = "Book with this ID already exists" });
return CreatedAtAction(nameof(GetBook), new { id = book.Id }, book);
return NoContent();

These helper methods create appropriate HTTP responses with correct status codes:

• Ok(): 200 OK

• NotFound(): 404 Not Found

• BadRequest(): 400 Bad Request

• CreatedAtAction(): 201 Created with a Location header pointing to the new resource

• NoContent(): 204 No Content

Github link

Book Record Repo

Sentry is a powerful error tracking tool for real-time monitoring of errors and exceptions. Integrating Sentry into your Django project allows you to manage errors effectively. Start by signing up on Sentry's website, creating a new project, and configuring your Django application to send error reports to Sentry's dashboard.

Getting Started with Sentry

1. Sign Up: Visit Sentry's website and create an account.

2. Create a Project: Define a new project for your Django application.

3. Configure Django: Install the Sentry SDK via pip and configure your settings file to initialize Sentry.

4. Monitoring Errors: Sentry captures errors and exceptions, providing detailed reports that help in debugging and resolving issues promptly.

1. Install Sentry SDK

First, install the Sentry SDK for Python using pip:

pip install sentry-sdk

2. Configure Sentry in Django Settings

In your Django project's settings.py, configure Sentry with your Sentry DSN (Data Source Name):

# settings.py

import sentry_sdk
from sentry_sdk.integrations.django import DjangoIntegration

# Initialize Sentry SDK
sentry_sdk.init(
    dsn='YOUR_SENTRY_DSN_HERE', 
    integrations=[DjangoIntegration()]
)

# Your Django settings configuration continues...

Replace 'YOUR_SENTRY_DSN_HERE' with your actual Sentry DSN, which you can obtain from your Sentry project settings.

3. Create a Django View with Error Handling

Next, create a Django view that intentionally raises an error:

# views.py

from django.shortcuts import render

def test_view(request):
    try:
        # Simulating an intentional error for demonstration
        result = 1 / 0  # This will raise a ZeroDivisionError
    except Exception as e:
        # Capture the exception and send it to Sentry
        sentry_sdk.capture_exception(e)

    context = {
        'result': result  # This will not be reached due to the error
    }
    return render(request, 'test.html', context)

4. Define URL Configuration

Configure the URL routing to map the view:

# urls.py

from django.urls import path
from .views import test_view

urlpatterns = [
    path('test/', test_view, name='test_view'),
]

5. Create a Template to Display Error Information

Create a template (test.html) to display a user-friendly error message:

<!-- test.html -->

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Error Test</title>
</head>
<body>
    <h1>Error Test</h1>
    <p>An error occurred while processing your request.</p>
</body>
</html>

Explanation:

• Sentry Initialization: sentry_sdk.init() initializes Sentry with Django integration. It captures all unhandled exceptions and reports them to Sentry.

• Error Handling in View: The test_view function demonstrates handling an error (ZeroDivisionError in this case) within a try-except block. The capture_exception method sends the exception details to Sentry.

• Template: test.html serves as a basic error page to inform users about the error.

Benefits:

Integrating Sentry with Django allows you to:

• Proactively Monitor Errors: Sentry captures errors in real-time, providing insights into exceptions occurring in your application.

• Effective Debugging: Detailed error reports (including stack traces, request details) help in quickly identifying and resolving issues.

This setup ensures that your Django application remains stable and reliable, enhancing both development and production environments with robust error handling and monitoring capabilities. Adjust the error handling and reporting strategy based on your application's specific requirements and Sentry's features.

The except block lets you handle the error.

The finally block lets you execute code, regardless of the result of the try- and except blocks.

try:
  print(x)
except:
  print("Something went wrong")
finally:
  print("The 'try except' is finished")

try:
    # code that might raise an exception
    result = 10 / 0
except ZeroDivisionError:
    # code to handle the exception
    print("Error: Division by zero")

try:
    number = int(input("Enter a number: "))
    result = 10 / number
except ValueError:
    print("Error: Invalid input")
except ZeroDivisionError:
    print("Error: Division by zero")
else:
    print(f"Result: {result}")

Different types of exception in python

• SyntaxError: This exception is raised when there is a syntax error in the Python code. It occurs when the code violates the rules of the Python language syntax.

• IndentationError: This exception is raised when there is an incorrect indentation in the Python code. Indentation is crucial in Python as it is used to define code blocks.

• NameError: This exception is raised when an identifier (e.g., a variable or function name) is not found in the local or global namespace.

• TypeError: This exception is raised when an operation or function is applied to an object of an inappropriate type.

• ValueError: This exception is raised when a function receives an argument of the correct type but an inappropriate value.

• IndexError: This exception is raised when an index is out of range for a sequence (e.g., list, string, or tuple).

• KeyError: This exception is raised when a dictionary key is not found in the dictionary.

• ZeroDivisionError: This exception is raised when an attempt is made to divide a number by zero.

• ImportError: This exception is raised when an imported module or package is not found or cannot be loaded.

• IOError: This exception is raised when an input/output operation (e.g., reading or writing to a file) fails.

• FileNotFoundError: This exception is a subclass of IOError and is raised when a file or directory is not found.

• AttributeError: This exception is raised when an attribute reference or assignment fails.

• KeyboardInterrupt: This exception is raised when the user interrupts the program's execution, usually by pressing Ctrl+C.

• MemoryError: This exception is raised when the program runs out of memory.

• OverflowError: This exception is raised when an arithmetic operation exceeds the maximum limit for a numeric type.

• RecursionError: This exception is raised when the maximum recursion depth is exceeded.

def keyword, followed by the function name and parentheses (). Any parameters go inside the parentheses.

def function_name(parameters):
    """
    Docstring: Brief description of the function
    """
    # Function body
    # Code block
    return value

Calling a function

function name followed by parentheses ()

function_name(arguments)

Parameters and Arguments

The values you pass into a function when calling it are called arguments. The variables listed in the function definition are called parameters.

def greet(name, greeting="Hello"):  # name is a parameter, greeting is a parameter with a default value
    print(f"{greeting}, {name}!")

greet("Alice")  # Alice is the argument
greet("Bob", "Hi")  # Bob is the argument, Hi is the argument

\Arbitrary Arguments (args)*

If you don't know how many arguments will be passed to a function, you can use the *args syntax to collect them into a tuple.

def print_numbers(*args):
    for arg in args:
        print(arg)

print_numbers(1, 2, 3)  # Output: 1 2 3

\*Keyword Arguments (kwargs)*

You can also collect arbitrary keyword arguments into a dictionary using the **kwargs syntax.

def print_info(**kwargs):
    for key, value in kwargs.items():
        print(f"{key}: {value}")

print_info(name="Alice", age=25)  # Output: name: Alice, age: 25

Lambda Functions

Python supports the creation of anonymous functions (lambda functions). These are small, one-line functions.

square = lambda x: x ** 2
print(square(5))

Python Classes/Objects

Python is an object oriented programming language.

Almost everything in Python is an object, with its properties and methods.

A Class is like an object constructor, or a "blueprint" for creating objects.

Define Python Class

We use the classkeyword to create a class in Python. For example,

class ClassName:
    # class definition

Here, we have created a class named ClassName.

Let's see an example,

class Room:
    length = 0
    breadth = 0

    def area(self):
        return self.length * self.breadth

1. Room - the name of the class

2. length and breadth are the attributes of the class

3. area is the method of the class

Understanding init method

 def __init__(self, length=0, breadth=0):
        self.length = length
        self.breadth = breadth

It is the constructor of the class Room. Meaning it is initialized everytime when the class is called(when object is created)

class Room:


    # Constructor
    def __init__(self, length=0, breadth=0):
        self.length = length
        self.breadth = breadth

    # Instance methods
    def area(self):
        return self.length * self.breadth

    def perimeter(self):
        return 2 * (self.length + self.breadth)

    def print_details(self):
        print(f"Room dimensions: {self.length} x {self.breadth} meters")
        print(f"Area: {self.area()} square meters")
        print(f"Perimeter: {self.perimeter()} meters")



# Creating instances (objects) of the Room class
room1 = Room(5, 4)
room2 = Room(3, 3)

# Calling instance methods
room1.print_details()
print()
room2.print_details()
print()

Inheritance:

class Room:
    # Class attribute
    num_rooms = 0

    # Constructor
    def __init__(self, length=0, breadth=0):
        self.length = length
        self.breadth = breadth
        Room.num_rooms += 1

    # Instance methods
    def area(self):
        return self.length * self.breadth

    def perimeter(self):
        return 2 * (self.length + self.breadth)

    def print_details(self):
        print(f"Room dimensions: {self.length} x {self.breadth} meters")
        print(f"Area: {self.area()} square meters")
        print(f"Perimeter: {self.perimeter()} meters")

# Child class inheriting from Room
class Bedroom(Room):
    def __init__(self, length, breadth, num_beds):
        super().__init__(length, breadth)
        self.num_beds = num_beds

    def print_details(self):
        super().print_details()
        print(f"Number of beds: {self.num_beds}")

# Creating instances of the classes
room1 = Room(5, 4)
bedroom1 = Bedroom(4, 3, 2)

# Calling instance methods
room1.print_details()
print()
bedroom1.print_details()

Download the Python Installer:

The first step is to download the latest version of Python from the official Python website (https://www.python.org/downloads/windows/). The website will automatically detect your operating system and offer the appropriate installer for your system (32-bit or 64-bit).

Step 2:

Run the Installer Once the installer has been downloadeddouble-click on it to run the installation process. You may be prompted by the User Account Control (UAC) to allow the installation. Click Yes to proceed.

Step 3:

During the installation process, you'll have the option to customize the installation. It's highly recommended to check the box next to "Add Python to PATH" before proceeding. This will ensure that Python is added to your system's PATH variable, making it easier to run Python from the command prompt.

Step 4: Install Python After selecting your desired installation settings, click Install to begin the installation process. This may take a few minutes.

Step 5: Verify the Installation Once the installation is complete, you can verify that Python has been installed correctly by opening the Command Prompt (search for "cmd" in the Start menu) and typing the following command:

python --version

Press Enter, and you should see the version of Python you installed displayed in the output.

Alternate Installation Method: Microsoft Store If you prefer, you can also install Python on Windows using the Microsoft Store. Search for "Python" in the Microsoft Store, find the latest version of Python 3.11, and click Install.

ubuntu/Debian

sudo apt-get install python3

• Equals: a == b

• Not Equals: a != b

• Less than: a < b

• Less than or equal to: a <= b

• Greater than: a > b

• Greater than or equal to: a >= b

if statement:

if condition:
    # code block
    # executed if condition is true

else statement:

if condition:
    # code block 1
else:
    # code block 2

elif statement:

if condition1:
    # code block 1
elif condition2:
    # code block 2
else:
    # code block 3

Loops:

There are two primitive looping statements in python

a. for loop

b. while loop

For loop:

The for loop is used to iterate over a sequence (such as a list, tuple, or string) or other iterable objects.

fruits = ["apple", "banana", "cherry"]
for fruit in fruits:
    print(fruit)

You can also use the range() function to generate a sequence of numbers:

for i in range(5):
    print(i)

While Loop The while loop executes a block of code as long as a given condition is true.

count = 0
while count < 5:
    print(count)
    count += 1

Break Statement The break statement is used to exit a loop prematurely.

for i in range(10):
    if i == 5:
        break
    print(i)  # Output: 0 1 2 3 4

Continue Statement The continue statement is used to skip the current iteration of a loop and move to the next one.

for i in range(10):
    if i == 5:
        continue
    print(i)  # Output: 0 1 2 3 4 6 7 8 9

Else Clause You can use an else clause with for and while loops. The else block is executed if the loop completes normally (without encountering a break statement).

for i in range(5):
    print(i)
else:
    print("Loop completed")

Nested Loops You can have one loop inside another loop. This is known as a nested loop.

for i in range(3):
    for j in range(3):
        print(i, j)