Glossary

121 terms from ASP.NET Core, in plain words, each with the chapter that teaches it.

Search the glossary

#

[ApiController]: An attribute that switches on API behavior for a controller. It validates each request before the action runs and answers 400 problem details.
[Authorize] attribute: The controller-style way to require a signed-in caller, optionally with `Roles = "staff"`. `[AllowAnonymous]` opens one action to everyone again.
[Fact] and [Theory]: xUnit attributes that mark test methods: `[Fact]` is a test with no inputs, and `[Theory]` runs the same test once for each `[InlineData]` row.

A

action: A public method on a controller class that handles a request. For example, `Get` in `ProductsController` answers `GET /products/{sku}`.
ActionResult<T>: A controller action's return type meaning "a `T` or some other result", such as a 404. It lets one method return either a Product or NotFound().
AddDbContext: The method that registers a DbContext such as `ShopDb` in the service container, scoped per request. It is usually paired with `UseNpgsql` and a connection string.
AllowedHosts: A setting in `appsettings.json` that lists the host names the app will answer to; `*` means any.
anonymous object: A C# object made with `new { ... }` without declaring a class. A handler can return one and ASP.NET Core serializes it to JSON.
appsettings.json: The project file that holds settings such as logging levels and the connection string. An environment-specific file like `appsettings.Development.json` overrides it.
AsNoTracking: An EF Core method used before `ToListAsync()` for read-only lists. It skips change tracking bookkeeping and makes big reads faster.
ASP.NET Core: Microsoft's free framework for building web apps and APIs, part of .NET. It offers minimal APIs and controllers.
ASPNETCORE_ENVIRONMENT: The environment variable that sets the app's environment, usually Development on your computer and Production on a server. `launchSettings.json` sets it to Development for `dotnet run`.
ASPNETCORE_URLS: Environment variables that set the address or port the app listens on. Using `http://0.0.0.0:8080` lets other computers reach a published app.
Authentication: Finding out who is calling, by checking the proof they send, such as a token. A failure gives 401.
Authorization: Deciding what an identified caller may do. A failure gives 403.

B

Bearer token: A token sent in the header `Authorization: Bearer <token>` to prove who you are. Whoever holds it is let in, so treat it like a password.
body: The data part of an HTTP message, such as the JSON of a new order sent in a POST.
builder: The object made by `WebApplication.CreateBuilder(args)` where you register services and settings before calling `Build()` to get the app.

C

category: The name shown with each log message, taken from the type given to `ILogger<T>`. Log level filters can be set per category.
Change tracking: EF Core remembers the entities it loaded and compares them when you save, so you never write an UPDATE yourself. It lasts only for one request's DbContext.
Claim: A fact about a caller stored in a token, such as their name or email. A role is a claim that groups callers, such as `staff`.
ClaimsPrincipal: The object representing the signed-in caller and their claims. A handler can take it as a parameter, and controllers expose it as `User`.
Concurrency token: A property EF Core checks when saving, so the UPDATE matches only if the value is still what the request read. Two cafés ordering the last bags at once can't both succeed.
Configuration: The settings your app reads instead of hard-coding them. They come from appsettings files, user secrets, environment variables and the command line, with later sources winning.
Connection string: A list of `name=value` pairs giving the database host, database name, user and password the app uses to connect to PostgreSQL.
Constructor injection: DI passes a class's dependencies in through its constructor, for example `ShopDb` receiving its options. It works for any registered class, not only handlers.
Container image: A package holding the app, a small Linux system and the .NET runtime, so any machine running Docker runs it the same way. `dotnet publish -t:PublishContainer` builds one.
Content-Type: The header saying what a body is, such as `application/json`. A POST with a JSON body but no such header gets 415.
Controller: A class whose public methods (actions) handle requests, the older alternative to minimal APIs. It is marked `[ApiController]` and `[Route]`.
ControllerBase: The base class for API controllers. It provides helpers such as `Ok()`, `NotFound()` and `CreatedAtAction()`.
Conventions: Rules EF Core follows by default so you don't configure everything, such as a property called `Id` becoming the primary key.
CORS: A browser rule that lets a web page read a response from another origin only if that server agrees, via headers like `Access-Control-Allow-Origin`. An origin is scheme, host and port together; a preflight is the browser's OPTIONS "may I?" request.
curl: A command-line tool that sends HTTP requests. `-i` shows status and headers, `-X` sets the method, `-H` adds a header and `-d` sends a body.

D

Data annotations: Attributes such as `[Required]` and `[Range(0.01, 1000)]` placed on a record's parameters to state validation rules ASP.NET Core checks.
DbContext: Your app's session with the database, which runs queries and saves changes. A DbSet is one table's rows, such as `Products`.
DbUpdateException: The exception EF Core throws when the database refuses a save. Its `DbUpdateConcurrencyException` subtype means another request changed the row first, and an inner `PostgresException` carries the SQL state.
Dependency injection: You register services once and ASP.NET Core hands them to any code that asks, instead of you creating them with `new`. A handler can just ask for an `IProductStore`.
Developer Exception Page: The detailed error and stack trace page shown in Development when a request crashes. It is useful to you but must never reach the public.
dotnet ef: The EF Core command-line tool installed with `dotnet tool install --global dotnet-ef`. It creates and applies migrations, makes scripts and drops databases.
dotnet new: The command that creates a project from a template. `dotnet new web -o KettleShop` makes an empty ASP.NET Core app.
dotnet publish: The command that builds a finished app for a server. `-c Release` optimizes it, `-o` picks the output folder, and `-r` with `--self-contained` bundles the runtime.
dotnet run: The command that builds and starts the app. `dotnet watch` restarts it each time you save a file.
dotnet test: The command that builds the projects and runs all the xUnit tests.
dotnet user-jwts: An SDK tool that makes development JWTs for your project (`create`, `print`, `list`). It stores a signing key in user secrets.
dotnet user-secrets: The command that stores settings like passwords and API keys outside the project folder, for example `dotnet user-secrets set "Shop:ApiKey" "k-4471"`.
DTO: A small record shaped for the caller, like `OrderDto`, instead of sending the database entity. It stops internal columns leaking and keeps callers from setting fields such as `Id` or `Total`.

E

Eager loading: Telling EF Core to load related rows in the same query with `Include(o => o.Lines)`. Without it, `Lines` comes back empty.
EF Core: Microsoft's ORM for .NET. You work with C# objects and LINQ, and it writes the SQL.
Endpoint: A method and path an API answers, such as `GET /products`.
Entity: A class EF Core maps to a table, such as `Product`. Each property becomes a column.
Environment: The app's setting for where it runs, usually Development on your computer and Production on a server. It decides which appsettings file applies and whether the Developer Exception Page shows.
Environment variable: A named value the operating system passes to a program. In ASP.NET Core settings you write `__` instead of `:`, so `Shop__Name` sets `Shop:Name`.

F

Fake sign-in (test authentication scheme): A test-only authentication handler, registered with `ConfigureTestServices`, that turns headers such as `X-Test-Email` into the caller's claims. Tests then need no real token.
Foreign key: A column that points at a row in another table, such as `OrderId` in an order line row.
Forwarded headers: Headers a reverse proxy adds to tell the app the caller's real scheme and address. The app ignores them until you enable them, and should do so only behind a proxy you control.
Framework-dependent: A framework-dependent publish needs the ASP.NET Core runtime on the server. A self-contained one carries the runtime for one operating system, named by a runtime identifier like `linux-x64`.

H

Headers: Extra facts sent with a request or response, one `Name: value` per line, such as Content-Type or Authorization.
Health check: An endpoint such as `/health` that a load balancer calls to see if a copy of the app works. It answers Healthy with 200 or Unhealthy with 503.
Host addresses (127.0.0.1, 0.0.0.0): `127.0.0.1` is the address of this computer itself (what `localhost` means), reachable only from that machine. `0.0.0.0` as a listen address means every network connection on the machine, so other computers can reach the app.
HTTP: The rules for conversation between client and server. A request has a method, path, headers and maybe a body; a response has a status code, headers and a body.
HTTP methods: The verb saying what to do: GET reads, POST creates, PUT replaces or updates, DELETE removes, and PATCH changes part of something.
HTTP status codes: The number in a response saying how it went: 2xx is success, 4xx means the caller made a mistake and 5xx means the server did. Common codes are 200 OK, 201 Created, 204 OK with no body, 400 bad input, 401 not signed in, 403 signed in but not allowed, 404 not found, 409 conflict with existing data, 415 unsupported media type, 500 server failed and 503 service unavailable.
HttpClient: The .NET class for sending HTTP requests. In tests, `factory.CreateClient()` returns one already pointed at the in-memory app.
HttpContext: The object that holds everything about the current request and response, such as `context.Request.Path` and `context.Response.StatusCode`.
HTTPS: The encrypted form of HTTP. `UseHttpsRedirection()` sends `http://` callers to `https://`.

I

IClassFixture<T>: An xUnit feature that creates one shared object, such as the app factory, for all tests in a class.
Idempotent: Safe to run more than once with the same result. An idempotent migration script checks `__EFMigrationsHistory` and skips migrations already applied.
Identity provider: A service that signs users in and issues tokens, such as Microsoft Entra ID, Auth0 or Keycloak. You set its `Authority` and `Audience` in configuration.
ILogger<T>: The interface for writing logs, which DI supplies. The `T` becomes the log category.
Integration test: A test that sends a real HTTP request to your app so routing, binding, validation and the handler are tested together. A unit test checks one method alone.
IOptions<T>: The interface a handler asks for to get a settings object read once at startup. `IOptionsSnapshot<T>` rereads the settings on every request.
Issuer and audience: Two JWT claims the API checks: the issuer (`iss`) is who made the token, and the audience (`aud`) is the API it is meant for. A token with the wrong audience, such as an old port's URL, is rejected with 401.

J

JSON: The text data format APIs send. Turning an object into JSON is serialization, done by `System.Text.Json`, which writes property names in camelCase.
JWT: A signed token of three dot-separated parts: header, payload of claims, and signature. It is signed, not encrypted, so anyone can read the payload.

K

Kestrel: The web server built into ASP.NET Core. `app.Run()` starts it and it reads each request from the network.

L

launchSettings.json: The file under `Properties` that controls how `dotnet run` starts the app, including its URL and environment. A published app does not read it.
Lifetime: How long the container keeps one service object: singleton for the whole app, scoped per request, transient every time it's asked for. A singleton must not depend on a scoped service.
Location header: A response header giving the new thing's address, set by `Results.Created`. `CreatedAtAction` builds it from another action's route in controllers.
Log level: A message's severity: Trace, Debug, Information, Warning, Error or Critical. `Logging:LogLevel` in appsettings decides which levels show for each category.

M

MapGroup: A call that makes endpoints share a path prefix, such as `/products`. It saves repeating the path and can carry shared rules like `RequireAuthorization`.
Message template: A log message like `"{Sku} is out of stock"` whose braces are filled from arguments. Values are kept as named data, so log tools can search for every message where `Sku` is `MUG-BLUE`.
Middleware: A step every request passes through, in the order added, with the response passing back out. Middleware that doesn't call `next` short-circuits and answers itself.
Migration: A C# file that changes the database to match your classes, with an `Up` method and a `Down` method. A model snapshot records the current model so the next migration contains only changes.
Migration bundle: A single program, built with `dotnet ef migrations bundle`, that applies the migrations when run with `--connection`. It is an alternative to an idempotent SQL script for updating a production database.
Minimal API: The style where each endpoint is mapped with one call such as `MapGet` and a lambda handler.
Model binding: Filling handler parameters from the route, query string, JSON body or registered services. Names matching the route come from the path, simple types from the query string and records from the body.

N

Navigation property: A property whose type is another entity or a list of them, such as `Order.Lines`, which lets EF Core set up a relationship.
Npgsql: The EF Core provider that connects it to PostgreSQL. `UseNpgsql` selects it with a connection string.
NuGet package: A library added to a project with `dotnet add package`, such as the Npgsql EF Core provider or JwtBearer.

O

One-to-many relationship: A link where one row relates to many others, like one order with several lines. In the database each line row holds its order's id.
Options pattern: Reading a whole section of settings into a class of your own, such as `ShopOptions`, through `IOptions<T>`. It avoids misspelled string keys.
ORM: A tool that lets you work with C# objects while it writes the SQL. EF Core is one.

P

Pagination: Listing results a page at a time. `Skip((page - 1) * 20)` jumps over earlier pages and `Take(20)` keeps one page.
Policy: A named authorization rule a caller must pass, such as `staff`, which requires the role `staff`.
Port: A number that picks one program on a computer. `localhost` means this computer.
Primary constructor: C# shorthand that puts a constructor's parameters after the class name, as in `class ShopDb(DbContextOptions<ShopDb> options)`. The parameters can be used anywhere in the class.
Primary key: The column that uniquely identifies a row. EF Core treats a property named `Id` as the primary key, and an `int` one is filled in by PostgreSQL.
Problem details: The standard JSON format for HTTP errors, with `type`, `title`, `status`, `detail` and for validation `errors`. `AddProblemDetails()` turns it on.
Provider: A library connecting EF Core to one kind of database; for PostgreSQL it's Npgsql.
psql: PostgreSQL's command-line client, used to run SQL scripts and inspect tables. `createdb` makes an empty database.

Q

Query string: The part of a URL after `?`, such as `?maxPrice=20`. Simple handler parameters not in the route are read from it.

R

record: A short C# class that holds data, like `Product(string Sku, ...)`. Records can't be changed in place, but `with` makes a changed copy.
RequireAuthorization: A call on an endpoint or route group that requires a signed-in caller, or a named policy such as `"staff"`. `.AllowAnonymous()` opens one endpoint again.
Results: Helper methods that pick the status code, such as `Ok` for 200 and `NotFound` for 404. `TypedResults` returns specific types, which helps tests and API documents.
Reverse proxy: A server in front of yours, such as Nginx or a cloud load balancer. It often handles TLS and passes plain HTTP to the app.
Route: A method and path pattern joined to a handler, the lambda that answers it. `MapGet` adds one.
Route parameter: A `{name}` part of a route filled from the path and passed to the handler parameter with the same name. A constraint like `{id:int}` limits what matches.

S

SaveChangesAsync: The EF Core call that writes all pending changes in one transaction: they all happen or none do.
Seed data: Rows EF Core inserts when it creates the table, defined with `HasData`, like the three starter products. Seed rows must set their `Id`.
Service: A class that does one job for the rest of the app, such as storing products. The service container (`builder.Services`) holds the registrations.
SQL state: PostgreSQL's five-character error code. `23505` means a unique constraint was broken.

T

Test isolation: Each test starts from a known state. `WithWebHostBuilder` with `ConfigureTestServices` swaps a service and `UseSetting` swaps a setting, such as pointing at a test database.
TestServer: An in-memory server with no port that `WebApplicationFactory` uses instead of Kestrel, so tests run the app without a network.
TLS: The encryption behind HTTPS. A reverse proxy usually handles it with the site's certificate.
Transaction: A group of database changes that all succeed or all fail together. One `SaveChangesAsync` call runs in one.

U

Unique index: A database index that stops two rows sharing a value, such as two products with the same SKU.
UseExceptionHandler: Middleware that catches exceptions, logs them and returns a 500 problem without a stack trace. `UseStatusCodePages()` adds problem bodies to bare errors like 404.
User secrets: A file in your user profile, outside the project, for passwords and API keys during development. They aren't encrypted, so they're for development only.

V

Validation: Checking each request as it arrives and refusing bad input with 400 before your handler runs. `AddValidation()` makes minimal APIs check data annotations.

W

Web API: A program that answers HTTP requests with data, usually JSON, rather than web pages.
WebApplicationFactory: A test class that starts your app in memory on TestServer, as `dotnet run` would. `CreateClient()` gives an HttpClient for it.