ASP.NET Core OpenAPI support is built in now: AddOpenApi and MapOpenApi write the document to /openapi/v1.json, and you add Scalar or Swagger UI to read it. We’ll build that for a small orders API, then lock it with a bearer token.

Here’s what we’re building. Scalar reads the generated OpenAPI 3.1 document and lists three order endpoints with a Bearer token box:

Why Doesn’t the .NET 10 Web API Template Have Swagger?

Starting with .NET 9, ASP.NET Core generates OpenAPI documents itself through the Microsoft.AspNetCore.OpenApi package, and Swashbuckle left the webapi template. It’s still a community package you can add by hand. The .NET 10 release kept that model and moved to OpenAPI 3.1.

If you’re moving an older project, the .NET 8 to .NET 10 upgrade guide covers the rest of the jump. Swashbuckle still works, so nothing forces you to rip it out on day one.

Before You Start the OpenAPI Build

You need the .NET 10 SDK (I used 10.0.402) and VS Code or Visual Studio. Not sure what’s installed? Check your .NET version first. The sample API serves four orders from an in-memory list:

These are the NuGet packages and exact versions this build uses (current stable on November 1, 2026):

Step 1: Create the Web API and Open /openapi/v1.json

Create the project from the template. It already references Microsoft.AspNetCore.OpenApi (the template pinned 10.0.13, so I bumped it):

dotnet new webapi -n OrdersApi -o OrdersApi
cd OrdersApi
dotnet add package Microsoft.AspNetCore.OpenApi --version 10.0.14

Replace the weather sample in Program.cs with the orders endpoints. The two OpenAPI lines are exactly what the template gives you, plus a YAML route:

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddOpenApi();

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();                                  // /openapi/v1.json
    app.MapOpenApi("/openapi/{documentName}.yaml");    // /openapi/v1.yaml
}

app.MapGet("/orders", (string? state) =>
    OrderStore.Orders.Where(o => state is null || o.State == state));

app.MapGet("/orders/{id:int}", (int id) =>
    OrderStore.Orders.FirstOrDefault(o => o.Id == id) is { } order
        ? Results.Ok(order)
        : Results.NotFound());

app.Run();

static class OrderStore
{
    public static readonly List<Order> Orders =
    [
        new(1001, "Jenna Morales", "Austin", "TX", 249.99m),
        new(1002, "Tyler Brooks", "Denver", "CO", 89.50m),
        new(1003, "Rachel Kim", "Seattle", "WA", 412.00m),
        new(1004, "Marcus Reed", "Dallas", "TX", 156.25m),
    ];
}

record Order(int Id, string Customer, string City, string State, decimal Total);

I trimmed Properties/launchSettings.json to one http profile on port 5280. It’s also where the Development environment comes from:

{
  "$schema": "https://json.schemastore.org/launchsettings.json",
  "profiles": {
    "http": {
      "commandName": "Project",
      "dotnetRunMessages": true,
      "launchBrowser": false,
      "applicationUrl": "http://localhost:5280",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    }
  }
}

I also deleted appsettings.Development.json and the .http file. This is the appsettings.json the template left:

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

Run dotnet run. Here’s the startup log:

Building...
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: http://localhost:5280
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: C:\DotNetDemo\OpenApiScalarDemo\OrdersApi

Now open http://localhost:5280/openapi/v1.json. That’s the default OpenAPI URL, /openapi/{documentName}.json with the document name v1. The top of the response:

{
  "openapi": "3.1.1",
  "info": {
    "title": "OrdersApi | v1",
    "version": "1.0.0"
  },
  "servers": [
    {
      "url": "http://localhost:5280/"
    }
  ],
  "paths": {

Raw JSON gets old fast, so I wrote a tiny checker. It’s a file-based app next to the project folder, not inside it, or the project would compile it too.

It uses JsonDocument and a little LINQ in C# to print one line per operation:

using System.Text.Json;

var http = new HttpClient { BaseAddress = new Uri("http://localhost:5280") };
var doc = JsonDocument.Parse(await http.GetStringAsync("/openapi/v1.json")).RootElement;
Console.WriteLine($"OpenAPI {doc.GetProperty("openapi")} | {doc.GetProperty("info").GetProperty("title")}");

foreach (var path in doc.GetProperty("paths").EnumerateObject())
    foreach (var op in path.Value.EnumerateObject())
    {
        var codes = op.Value.GetProperty("responses").EnumerateObject().Select(r => r.Name);
        var summary = op.Value.TryGetProperty("summary", out var s) ? s.GetString() : "-";
        var locked = op.Value.TryGetProperty("security", out _) ? " [Bearer]" : "";
        Console.WriteLine($"{op.Name.ToUpper(),-5}{path.Name,-14}{string.Join(",", codes),-9}{summary}{locked}");
    }

if (doc.GetProperty("components").TryGetProperty("securitySchemes", out var schemes))
    foreach (var sc in schemes.EnumerateObject())
        Console.WriteLine($"Security scheme: {sc.Name} = {sc.Value.GetProperty("type")} {sc.Value.GetProperty("scheme")}");

Output:

OpenAPI 3.1.1 | OrdersApi | v1
GET  /orders       200      -
GET  /orders/{id}  200      -

Two things stand out. The document is OpenAPI 3.1.1 with no extra setting, and GET /orders/{id} lists only a 200 response with no schema, because Results.Ok returns a plain IResult. We’ll fix that in Step 3.

The YAML route works too. /openapi/v1.yaml returned 200:

openapi: '3.1.1'
info:
  title: OrdersApi | v1
  version: 1.0.0
servers:
  - url: http://localhost:5280/
paths:
  /orders:

Checkpoint: /openapi/v1.json returns 200, CheckDocs prints OpenAPI 3.1.1 | OrdersApi | v1, and /swagger still returns 404.

Step 2: Add Scalar with MapScalarApiReference

Scalar is an open-source OpenAPI UI that Microsoft’s docs show next to Swagger UI. Add the package, then one using and one line inside the Development block:

dotnet add package Scalar.AspNetCore --version 2.18.7

using Scalar.AspNetCore;

// ...
if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();                                  // /openapi/v1.json
    app.MapOpenApi("/openapi/{documentName}.yaml");    // /openapi/v1.yaml
    app.MapScalarApiReference();                       // /scalar
}

Restart and browse to /scalar/v1. In my run /scalar answered 302 and redirected to /scalar/, and /scalar/v1 returned 200:

Scalar reads the same /openapi/v1.json, so whatever your document lacks, your page lacks. Right now you’re missing titles, descriptions and response types.

Checkpoint: Scalar shows OrdersApi | v1 and two GET endpoints.

Step 3: Describe OpenAPI Endpoints with WithSummary, TypedResults and XML Comments

This step changes the document, not the UI. I grouped the routes with MapGroup and WithTags, gave each one WithSummary or WithDescription, and switched to TypedResults so the response types show up. A document transformer sets the title:

builder.Services.AddOpenApi(options =>
{
    options.AddDocumentTransformer((document, context, ct) =>
    {
        document.Info = new() { Title = "Orders API", Version = "v1",
            Description = "Orders for a small US outdoor-gear store." };
        return Task.CompletedTask;
    });
});

var api = app.MapGroup("/orders").WithTags("Orders");

api.MapGet("/", (string? state) =>
        TypedResults.Ok(OrderStore.Orders.Where(o => state is null || o.State == state)))
   .WithSummary("List orders")
   .WithDescription("Returns every order, or only the orders shipped to one US state (TX, CO, WA).");

api.MapGet("/{id:int}", OrderStore.GetOrderById);

api.MapPost("/", (NewOrder input) =>
    {
        var order = new Order(OrderStore.Orders.Max(o => o.Id) + 1,
            input.Customer, input.City, input.State, input.Total);
        OrderStore.Orders.Add(order);
        return TypedResults.Created($"/orders/{order.Id}", order);
    })
   .WithSummary("Create an order");

GET /orders/{id} is a named method, so I documented it with XML comments instead. In .NET 10 a source generator copies them into the document when the project has <GenerateDocumentationFile>true</GenerateDocumentationFile> (it’s in the csproj in Step 7):

static class OrderStore
{
    // ... Orders list from Step 1 ...

/// <summary>Get one order by its number.</summary>
/// <param name="id">The order number, for example 1001.</param>
/// <response code="200">The order was found.</response>
/// <response code="404">No order has that number.</response>
public static Results<Ok<Order>, NotFound> GetOrderById(int id) =>
    Orders.FirstOrDefault(o => o.Id == id) is { } order
        ? TypedResults.Ok(order)
        : TypedResults.NotFound();
}

The return type Results<Ok<Order>, NotFound> tells OpenAPI about both the 200 and the 404, and the response tags only add the descriptions. The checker now prints:

OpenAPI 3.1.1 | Orders API
GET  /orders       200      List orders
POST /orders       201      Create an order
GET  /orders/{id}  200,404  Get one order by its number.

One surprise in the schema: decimal Total (and int Id) came out as a number or a string, because ASP.NET Core’s web JSON defaults accept numbers in quotes. Here’s the real snippet:

"total": {
  "pattern": "^-?(?:0|[1-9]\\d*)(?:\\.\\d+)?$",
  "type": [
    "number",
    "string"
  ],
  "format": "double"
}

If you’d rather send plain numbers, tune the serializer options; my notes on System.Text.Json options for clean JSON cover the same settings.

Checkpoint: every operation has a summary, and GET /orders/{id} lists 200,404.

Step 4: Add Swagger UI to the .NET 10 OpenAPI Document (Optional)

Prefer the classic Swagger page? You don’t need all of Swashbuckle. Swashbuckle.AspNetCore.SwaggerUI is just the UI, and you point it at the document ASP.NET Core already generates:

dotnet add package Swashbuckle.AspNetCore.SwaggerUI --version 10.3.1

app.UseSwaggerUI(o => o.SwaggerEndpoint("/openapi/v1.json", "Orders API v1"));

Put that line inside the same Development block. In my run /swagger returned 301 (a redirect) and /swagger/index.html returned 200:

Don’t call AddSwaggerGen or UseSwagger here. They’d generate a second document from Swashbuckle, and you’d have two sources of truth. Running Scalar and Swagger UI side by side is fine, since both read the same JSON.

Checkpoint: Swagger UI lists the same three operations and summaries as Scalar.

Step 5: Keep the OpenAPI Docs in Development Only

Every docs line in this build sits inside if (app.Environment.IsDevelopment()). Microsoft recommends that for Swagger UI, ReDoc and Scalar, so you don’t hand your API map to the internet. I ran the final app with ASPNETCORE_ENVIRONMENT=Production on port 5281 to prove it:

404  /openapi/v1.json
404  /scalar/v1
404  /swagger/index.html
200  /orders

The docs vanish and the API keeps working. If a staging site needs docs, add a check for that environment name rather than deleting the if.

Checkpoint: all three docs URLs return 404 in Production while /orders returns 200.

Step 6: Add OpenAPI Authentication with a Bearer Security Scheme

Next, lock POST /orders behind a JWT. Two parts, and people usually forget the second: the app has to require the token, and the OpenAPI document has to say so, or Scalar’s token box does nothing.

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer --version 10.0.14

In .NET 10 the OpenAPI types live in the Microsoft.OpenApi namespace (it was Microsoft.OpenApi.Models in .NET 9). A document transformer adds the scheme, written as an interface implementation:

sealed class BearerSecuritySchemeTransformer : IOpenApiDocumentTransformer
{
    public Task TransformAsync(OpenApiDocument document,
        OpenApiDocumentTransformerContext context, CancellationToken ct)
    {
        document.Components ??= new OpenApiComponents();
        document.Components.SecuritySchemes = new Dictionary<string, IOpenApiSecurityScheme>
        {
            ["Bearer"] = new OpenApiSecurityScheme
            {
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                In = ParameterLocation.Header,
                BearerFormat = "JWT"
            }
        };
        return Task.CompletedTask;
    }
}

An operation transformer then marks only the endpoints that carry authorization metadata, so the public GETs stay open in the docs:

builder.Services.AddAuthentication().AddJwtBearer();
builder.Services.AddAuthorization();
builder.Services.AddOpenApi(options =>
{
    // ... Info transformer from Step 3 ...
options.AddDocumentTransformer<BearerSecuritySchemeTransformer>();
options.AddOperationTransformer((operation, context, ct) =>
{
    bool needsToken = context.Description.ActionDescriptor.EndpointMetadata
        .OfType<IAuthorizeData>().Any();
    if (needsToken)
    {
        operation.Security ??= [];
        operation.Security.Add(new OpenApiSecurityRequirement
        {
            [new OpenApiSecuritySchemeReference("Bearer", context.Document)] = []
        });
    }
    return Task.CompletedTask;
});
});

Finally, .Produces(StatusCodes.Status401Unauthorized) and .RequireAuthorization() go on the POST, and AddPreferredSecuritySchemes("Bearer") makes Scalar preselect it. Here’s the whole Program.cs at this point:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http.HttpResults;
using Microsoft.AspNetCore.OpenApi;
using Microsoft.OpenApi;
using Scalar.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication().AddJwtBearer();
builder.Services.AddAuthorization();
builder.Services.AddOpenApi(options =>
{
    options.AddDocumentTransformer((document, context, ct) =>
    {
        document.Info = new() { Title = "Orders API", Version = "v1",
            Description = "Orders for a small US outdoor-gear store." };
        return Task.CompletedTask;
    });
options.AddDocumentTransformer<BearerSecuritySchemeTransformer>();
options.AddOperationTransformer((operation, context, ct) =>
{
    bool needsToken = context.Description.ActionDescriptor.EndpointMetadata
        .OfType<IAuthorizeData>().Any();
    if (needsToken)
    {
        operation.Security ??= [];
        operation.Security.Add(new OpenApiSecurityRequirement
        {
            [new OpenApiSecuritySchemeReference("Bearer", context.Document)] = []
        });
    }
    return Task.CompletedTask;
});
});

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();                                  // /openapi/v1.json
    app.MapOpenApi("/openapi/{documentName}.yaml");    // /openapi/v1.yaml
    app.MapScalarApiReference(o => o.AddPreferredSecuritySchemes("Bearer"));
    app.UseSwaggerUI(o => o.SwaggerEndpoint("/openapi/v1.json", "Orders API v1"));
}

var api = app.MapGroup("/orders").WithTags("Orders");

api.MapGet("/", (string? state) =>
        TypedResults.Ok(OrderStore.Orders.Where(o => state is null || o.State == state)))
   .WithSummary("List orders")
   .WithDescription("Returns every order, or only the orders shipped to one US state (TX, CO, WA).");

api.MapGet("/{id:int}", OrderStore.GetOrderById);

api.MapPost("/", (NewOrder input) =>
    {
        var order = new Order(OrderStore.Orders.Max(o => o.Id) + 1,
            input.Customer, input.City, input.State, input.Total);
        OrderStore.Orders.Add(order);
        return TypedResults.Created($"/orders/{order.Id}", order);
    })
   .WithSummary("Create an order")
   .Produces(StatusCodes.Status401Unauthorized)
   .RequireAuthorization();

app.Run();

static class OrderStore
{
    public static readonly List<Order> Orders =
    [
        new(1001, "Jenna Morales", "Austin", "TX", 249.99m),
        new(1002, "Tyler Brooks", "Denver", "CO", 89.50m),
        new(1003, "Rachel Kim", "Seattle", "WA", 412.00m),
        new(1004, "Marcus Reed", "Dallas", "TX", 156.25m),
    ];

/// <summary>Get one order by its number.</summary>
/// <param name="id">The order number, for example 1001.</param>
/// <response code="200">The order was found.</response>
/// <response code="404">No order has that number.</response>
public static Results<Ok<Order>, NotFound> GetOrderById(int id) =>
    Orders.FirstOrDefault(o => o.Id == id) is { } order
        ? TypedResults.Ok(order)
        : TypedResults.NotFound();
}

record Order(int Id, string Customer, string City, string State, decimal Total);
record NewOrder(string Customer, string City, string State, decimal Total);

sealed class BearerSecuritySchemeTransformer : IOpenApiDocumentTransformer
{
    public Task TransformAsync(OpenApiDocument document,
        OpenApiDocumentTransformerContext context, CancellationToken ct)
    {
        document.Components ??= new OpenApiComponents();
        document.Components.SecuritySchemes = new Dictionary<string, IOpenApiSecurityScheme>
        {
            ["Bearer"] = new OpenApiSecurityScheme
            {
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                In = ParameterLocation.Header,
                BearerFormat = "JWT"
            }
        };
        return Task.CompletedTask;
    }
}

using System.Text.Json;

var http = new HttpClient { BaseAddress = new Uri("http://localhost:5280") };
var doc = JsonDocument.Parse(await http.GetStringAsync("/openapi/v1.json")).RootElement;
Console.WriteLine($"OpenAPI {doc.GetProperty("openapi")} | {doc.GetProperty("info").GetProperty("title")}");

foreach (var path in doc.GetProperty("paths").EnumerateObject())
    foreach (var op in path.Value.EnumerateObject())
    {
        var codes = op.Value.GetProperty("responses").EnumerateObject().Select(r => r.Name);
        var summary = op.Value.TryGetProperty("summary", out var s) ? s.GetString() : "-";
        var locked = op.Value.TryGetProperty("security", out _) ? " [Bearer]" : "";
        Console.WriteLine($"{op.Name.ToUpper(),-5}{path.Name,-14}{string.Join(",", codes),-9}{summary}{locked}");
    }

if (doc.GetProperty("components").TryGetProperty("securitySchemes", out var schemes))
    foreach (var sc in schemes.EnumerateObject())
        Console.WriteLine($"Security scheme: {sc.Name} = {sc.Value.GetProperty("type")} {sc.Value.GetProperty("scheme")}");

Output:

OpenAPI 3.1.1 | Orders API
GET  /orders       200      List orders
POST /orders       201,401  Create an order [Bearer]
GET  /orders/{id}  200,404  Get one order by its number.
Security scheme: Bearer = http bearer

Checkpoint: [Bearer] appears on POST /orders only, and the last line reads Security scheme: Bearer = http bearer.

Step 7: Generate the OpenAPI Document at Build Time

Client generators and CI linters want a file, not a running server. Add Microsoft.Extensions.ApiDescription.Server and turn on OpenApiGenerateDocumentsOnBuild. Here’s the final project file:

dotnet add package Microsoft.Extensions.ApiDescription.Server --version 10.0.14

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <GenerateDocumentationFile>true</GenerateDocumentationFile>
    <OpenApiGenerateDocumentsOnBuild>true</OpenApiGenerateDocumentsOnBuild>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.14" />
    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.14" />
    <PackageReference Include="Microsoft.Extensions.ApiDescription.Server" Version="10.0.14">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
    <PackageReference Include="Scalar.AspNetCore" Version="2.18.7" />
    <PackageReference Include="Swashbuckle.AspNetCore.SwaggerUI" Version="10.3.1" />
  </ItemGroup>

</Project>

dotnet build now starts the app’s host briefly and writes obj/OrdersApi.json. In the shot I deleted the file and rebuilt with --no-incremental, so you can see it come back:

del obj\OrdersApi.json & dotnet build --no-incremental -v:m -tl:off -nologo && findstr /n openapi obj\OrdersApi.json

The first lines of the generated file match what you saw from the live endpoint:

{
  "openapi": "3.1.1",
  "info": {
    "title": "Orders API",
    "description": "Orders for a small US outdoor-gear store.",
    "version": "v1"

Want it next to the csproj instead? Set OpenApiDocumentsDirectory to $(MSBuildProjectDirectory). YAML output at build time isn’t supported yet in .NET 10, so build-time files are JSON.

Checkpoint: obj/OrdersApi.json exists after the build and starts with "openapi": "3.1.1".

Test the OpenAPI Bearer Lock and Endpoints

The docs say POST needs a token, so the API had better agree. Posting an order for Ava Thompson in Phoenix without one:

curl.exe -i -X POST http://localhost:5280/orders -H "Content-Type: application/json" -d "{\"customer\":\"Ava Thompson\",\"city\":\"Phoenix\",\"state\":\"AZ\",\"total\":74.10}"

HTTP/1.1 401 Unauthorized
Content-Length: 0
Server: Kestrel
WWW-Authenticate: Bearer

A 401 with WWW-Authenticate: Bearer, exactly as documented. The open endpoints still answer; GET /orders?state=TX returns the two Texas orders:

[{"id":1001,"customer":"Jenna Morales","city":"Austin","state":"TX","total":249.99},{"id":1004,"customer":"Marcus Reed","city":"Dallas","state":"TX","total":156.25}]

And GET /orders/2001 returned 404, the 404 the XML comment describes. A filter like this is plain List<T> in C# filtering, so swap in EF Core when the data gets real.

Troubleshooting ASP.NET Core OpenAPI and Scalar

/swagger returns 404. Expected on .NET 9 and 10. Use /openapi/v1.json or /scalar/v1, or add the Swagger UI package from Step 4.

The type IOpenApiDocumentTransformer could not be found. I hit this on my first build. The transformer types need using Microsoft.AspNetCore.OpenApi;, and the model types need using Microsoft.OpenApi; in .NET 10.

Scalar ignores the token you paste. The document has no security scheme. Add the transformer from Step 6 and check that components.securitySchemes appears in the JSON.

XML comments don’t show up. They apply to named methods and types, not to inline lambdas, and need GenerateDocumentationFile. Use WithSummary for lambdas.

Deleted obj/OrdersApi.json and the build didn’t recreate it. I hit this too: an up-to-date build skips the generator, so findstr couldn’t find the file. Rebuild with dotnet build --no-incremental.

Note: a 500 on /openapi/v1.json usually means an endpoint threw during generation; wrap that handler’s logic in a try-catch in C# while you find it, and read the server log.

Where to Take It Next with ASP.NET Core OpenAPI

Add a sign-in flow that issues the JWT; my OTP sign-in API in ASP.NET Core is one way to get there. Then feed the build-time JSON to a client generator such as Kiota or NSwag.

If production still runs .NET 8, check the .NET 8 and .NET 9 end-of-support dates before you plan the move to the built-in generator.

More ASP.NET Core and .NET reading on the site:

• All ASP.NET Core tutorials on AspDotnetHelp
• Every .NET version and what changed
• Dictionary in C# for a keyed order lookup
• Create a console app in VS Code

Frequently Asked Questions

Bijay Kumar

Bijay Kumar is a renowned software engineer, accomplished author, and distinguished Microsoft Most Valuable Professional (MVP) specializing in SharePoint. With a rich professional background spanning over 15 years, Bijay has established himself as an authority in the field of information technology. He possesses unparalleled expertise in multiple programming languages and technologies such as ASP.NET, ASP.NET MVC, C#.NET, and SharePoint, which has enabled him to develop innovative and cutting-edge solutions for clients across the globe. Read more…

aspdotnethelp.com

The short answer: to upgrade .NET 8 to .NET 10, install the .NET 10 SDK, point global.json at it, change net8.0 to net10.0, update your Microsoft packages to 10.0.x, then fix the warnings and breaking changes the build shows you.

In this tutorial, I’ll upgrade .NET 8 to .NET 10 on a real ASP.NET Core Minimal API, step by step. You’ll see the app running on .NET 8, the crash I hit halfway through, the fix, and the same app running on .NET 10.

What You Need Before You Upgrade .NET 8 to .NET 10

My demo is a small “US store orders” Minimal API. It uses EF Core with the InMemory provider, Swashbuckle for Swagger, and Microsoft.AspNetCore.OpenApi, all pinned at 8.x like a typical project created from the .NET 8 template.

I work in VS Code on Windows 11. You need the .NET 10 SDK installed next to the .NET 8 one, and it doesn’t remove anything. If you’re not sure what’s on your machine, here’s how to check which .NET version is installed:

dotnet --list-sdks
dotnet --version

Output:

7.0.403 [C:\Program Files\dotnet\sdk]
8.0.427 [C:\Program Files\dotnet\sdk]
10.0.402 [C:\Program Files\dotnet\sdk]
8.0.427

The --list-sdks command ignores global.json, but dotnet --version doesn’t. That’s why it prints 8.0.427: my folder still pins the .NET 8 SDK.

Step 1: Run the ASP.NET Core App on .NET 8 First

Never start an upgrade from a broken build. I want proof of what works today, so I can compare after the change. Here’s the folder layout:

UpgradeDemo
├── global.json
└── UsStoreOrders
    ├── UsStoreOrders.csproj
    ├── Program.cs
    ├── appsettings.json
    └── UsStoreOrders.http

This is the .NET 8 global.json. The rollForward policy lets the CLI use a newer 8.0 feature band if one is installed:

{
  "sdk": {
    "version": "8.0.427",
    "rollForward": "latestFeature"
  }
}

And the project file, with the same package versions you’d find in a lot of 2024 projects:

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="8.0.11" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="8.0.11" />
    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
  </ItemGroup>

</Project>

Program.cs follows the .NET 8 Web API template: Swashbuckle for Swagger, WithOpenApi() on each endpoint, and an /about endpoint that reports the runtime with RuntimeInformation.FrameworkDescription:

using System.Runtime.InteropServices;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();
builder.Services.AddDbContext<StoreDb>(o => o.UseInMemoryDatabase("orders"));
var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

using (var scope = app.Services.CreateScope())
{
    var db = scope.ServiceProvider.GetRequiredService<StoreDb>();
    db.Orders.AddRange(
        new Order(1001, "Jenna Moore", "Austin", "TX", 249.99m),
        new Order(1002, "Ryan Carter", "Denver", "CO", 89.50m),
        new Order(1003, "Chloe Brady", "Seattle", "WA", 1325.00m));
    db.SaveChanges();
}

app.MapGet("/about", () => new
{
    Runtime = RuntimeInformation.FrameworkDescription,
    Target = AppContext.TargetFrameworkName
}).WithName("About").WithOpenApi();

app.MapGet("/orders", (StoreDb db) => db.Orders.OrderBy(o => o.Id).ToListAsync())
   .WithName("ListOrders").WithOpenApi();

app.MapGet("/orders/{id:int}", async (int id, StoreDb db) =>
    await db.Orders.FindAsync(id) is Order o ? Results.Ok(o) : Results.NotFound())
   .WithName("GetOrder").WithOpenApi();

app.Run();

public record Order(int Id, string Customer, string City, string State, decimal Total);

public class StoreDb(DbContextOptions<StoreDb> options) : DbContext(options)
{
    public DbSet<Order> Orders => Set<Order>();
}

The appsettings.json file sets the URL and quiets the logs. Records like Order are a compact way to model data; if they’re new, compare them with a structure in C#.

{
  "Logging": {
    "LogLevel": {
      "Default": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  },
  "AllowedHosts": "*",
  "Urls": "http://localhost:5280"
}

I keep a UsStoreOrders.http file for quick manual calls from the editor:

@host = http://localhost:5280

GET {{host}}/about
Accept: application/json

###

GET {{host}}/orders/1001
Accept: application/json

I started the API with dotnet run --project UsStoreOrders -- --environment Development in one terminal and called it from another:

dotnet --version
curl -s -w "\n" http://localhost:5280/about
curl -s -w "\n" http://localhost:5280/orders/1001
curl -s -o NUL -w "swagger.json: %{http_code}\n" http://localhost:5280/swagger/v1/swagger.json

Output:

8.0.427
{"runtime":".NET 8.0.33","target":".NETCoreApp,Version=v8.0"}
{"id":1001,"customer":"Jenna Moore","city":"Austin","state":"TX","total":249.99}
swagger.json: 200

Everything works: the SDK is 8.0.427, the runtime is .NET 8.0.33, and Swagger answers. You can browse more Minimal API projects like this one in my ASP.NET Core tutorials.

Step 2: Install the .NET 10 SDK and Update global.json

Download the .NET 10 SDK from dotnet.microsoft.com, or use winget install Microsoft.DotNet.SDK.10. Then change the version in global.json. Microsoft’s migration guide shows this exact edit:

{
  "sdk": {
    "version": "10.0.100",
    "rollForward": "latestFeature"
  }
}

I used 10.0.100 with latestFeature, so any newer 10.0 SDK satisfies it. Check that the CLI picked it up:

dotnet --version

Output:

10.0.402

If you skip this step, the build fails because a .NET 8 SDK can’t target net10.0. Not sure if you even need to move? My post on .NET 8 and .NET 9 end of support explains what happens after November 10.

Step 3: Change TargetFramework From net8.0 to net10.0

Next, edit the project file. This one-line change is what most people mean by upgrading to .NET 10:

<TargetFramework>net10.0</TargetFramework>

I changed only the target framework and left every package at 8.x, then built:

dotnet build UsStoreOrders

Output:

  Determining projects to restore...
  Restored C:\DotNetDemo\UpgradeDemo\UsStoreOrders\UsStoreOrders.csproj (in 348 ms).
  UsStoreOrders -> C:\DotNetDemo\UpgradeDemo\UsStoreOrders\bin\Debug\net10.0\UsStoreOrders.dll

Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:00:02.21

No warnings, no errors. The 8.x packages still compile against .NET 10, which surprises people. But a clean build doesn’t mean the upgrade’s done, because you’re still shipping .NET 8 libraries that won’t get .NET 10 fixes.

With several projects, change all of them together, or move the property into a shared Directory.Build.props. Tracking each project’s settings is easier when you know your namespaces and project structure well.

Step 4: Update NuGet Packages to the .NET 10 Versions

Microsoft’s guidance is to update every Microsoft.AspNetCore.*, Microsoft.EntityFrameworkCore.*, Microsoft.Extensions.* and System.Net.Http.Json reference to 10.0.0 or later. To see what’s behind, run:

dotnet list UsStoreOrders package --outdated

Output:

  Determining projects to restore...
  All projects are up-to-date for restore.

The following sources were used:
   https://api.nuget.org/v3/index.json
   C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\

Project `UsStoreOrders` has the following updates to its packages
   [net10.0]: 
   Top-level Package                             Requested   Resolved   Latest 
   > Microsoft.AspNetCore.OpenApi                8.0.11      8.0.11     10.0.14
   > Microsoft.EntityFrameworkCore.InMemory      8.0.11      8.0.11     10.0.14
   > Swashbuckle.AspNetCore                      6.6.2       6.6.2      10.3.1

I updated the two Microsoft packages with dotnet add package, which rewrites the version in the project file:

dotnet add UsStoreOrders package Microsoft.AspNetCore.OpenApi --version 10.0.14
dotnet add UsStoreOrders package Microsoft.EntityFrameworkCore.InMemory --version 10.0.14

I left Swashbuckle at 6.6.2 on purpose. Many teams update only the Microsoft packages first, and I wanted to see what happens. Here’s the project file at that point:

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.14" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.14" />
    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
  </ItemGroup>

</Project>

Step 5: Fix the .NET 10 Breaking Changes You Hit

This is where my upgrade got interesting. The build passed, but with warnings, and the app crashed before it served a single request:

dotnet run --project UsStoreOrders -- --environment Development

Output:

C:\DotNetDemo\UpgradeDemo\UsStoreOrders\Program.cs(26,1): warning ASPDEPR002: 'OpenApiEndpointConventionBuilderExtensions.WithOpenApi<TBuilder>(TBuilder)' is obsolete: 'WithOpenApi is deprecated and will be removed in a future release. For more information, visit https://aka.ms/aspnet/deprecate/002.' (https://aka.ms/aspnet/deprecate/002) [C:\DotNetDemo\UpgradeDemo\UsStoreOrders\UsStoreOrders.csproj]
C:\DotNetDemo\UpgradeDemo\UsStoreOrders\Program.cs(32,1): warning ASPDEPR002: 'OpenApiEndpointConventionBuilderExtensions.WithOpenApi<TBuilder>(TBuilder)' is obsolete: 'WithOpenApi is deprecated and will be removed in a future release. For more information, visit https://aka.ms/aspnet/deprecate/002.' (https://aka.ms/aspnet/deprecate/002) [C:\DotNetDemo\UpgradeDemo\UsStoreOrders\UsStoreOrders.csproj]
C:\DotNetDemo\UpgradeDemo\UsStoreOrders\Program.cs(35,1): warning ASPDEPR002: 'OpenApiEndpointConventionBuilderExtensions.WithOpenApi<TBuilder>(TBuilder)' is obsolete: 'WithOpenApi is deprecated and will be removed in a future release. For more information, visit https://aka.ms/aspnet/deprecate/002.' (https://aka.ms/aspnet/deprecate/002) [C:\DotNetDemo\UpgradeDemo\UsStoreOrders\UsStoreOrders.csproj]
Unhandled exception. System.TypeLoadException: Method 'GetSwagger' in type 'Swashbuckle.AspNetCore.SwaggerGen.SwaggerGenerator' from assembly 'Swashbuckle.AspNetCore.SwaggerGen, Version=6.6.2.0, Culture=neutral, PublicKeyToken=d84d99fb0135530a' does not have an implementation.
   at Microsoft.Extensions.DependencyInjection.SwaggerGenServiceCollectionExtensions.AddSwaggerGen(IServiceCollection services, Action`1 setupAction)
   at Microsoft.Extensions.DependencyInjection.SwaggerGenServiceCollectionExtensions.AddSwaggerGen(IServiceCollection services, Action`1 setupAction)
   at Program.<Main>$(String[] args) in C:\DotNetDemo\UpgradeDemo\UsStoreOrders\Program.cs:line 6

Exceptions at startup like this one can’t be handled with a try-catch block in C#, because the type itself fails to load. You fix them by fixing the package graph.

Fix 1: Replace Swashbuckle 6.x With AddOpenApi and MapOpenApi

Microsoft.AspNetCore.OpenApi 10.0 brings in a newer Microsoft.OpenApi library than Swashbuckle 6.6.2 was built for. The TypeLoadException on GetSwagger is that mismatch. You have two ways out:

• Upgrade Swashbuckle too. dotnet list package --outdated showed 10.3.1; I tried it in a copy of the project, and it started and served swagger.json on .NET 10.
• Drop Swashbuckle and use the built-in generator. The ASP.NET Core Web API template now calls AddOpenApi() and MapOpenApi() instead.

I went with the built-in option, since it’s one package fewer to keep in sync. I removed the package from the CLI:

dotnet remove UsStoreOrders package Swashbuckle.AspNetCore

Fix 2: Remove WithOpenApi to Clear ASPDEPR002

Microsoft deprecated WithOpenApi in .NET 10. It still compiles and runs, but every call raises warning ASPDEPR002:

C:\DotNetDemo\UpgradeDemo\UsStoreOrders\Program.cs(26,1): warning ASPDEPR002: 'OpenApiEndpointConventionBuilderExtensions.WithOpenApi<TBuilder>(TBuilder)' is obsolete: 'WithOpenApi is deprecated and will be removed in a future release. For more information, visit https://aka.ms/aspnet/deprecate/002.' (https://aka.ms/aspnet/deprecate/002) [C:\DotNetDemo\UpgradeDemo\UsStoreOrders\UsStoreOrders.csproj]

The fix is to delete the .WithOpenApi() calls. If you used the overload to tweak an operation, move that code into AddOpenApiOperationTransformer. Swashbuckle users would use an IOperationFilter, a plain interface in C# you implement.

Here’s the finished .NET 10 Program.cs:

using System.Runtime.InteropServices;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddOpenApi();
builder.Services.AddDbContext<StoreDb>(o => o.UseInMemoryDatabase("orders"));
var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();
}

using (var scope = app.Services.CreateScope())
{
    var db = scope.ServiceProvider.GetRequiredService<StoreDb>();
    db.Orders.AddRange(
        new Order(1001, "Jenna Moore", "Austin", "TX", 249.99m),
        new Order(1002, "Ryan Carter", "Denver", "CO", 89.50m),
        new Order(1003, "Chloe Brady", "Seattle", "WA", 1325.00m));
    db.SaveChanges();
}

app.MapGet("/about", () => new
{
    Runtime = RuntimeInformation.FrameworkDescription,
    Target = AppContext.TargetFrameworkName
}).WithName("About");

app.MapGet("/orders", (StoreDb db) => db.Orders.OrderBy(o => o.Id).ToListAsync())
   .WithName("ListOrders");

app.MapGet("/orders/{id:int}", async (int id, StoreDb db) =>
    await db.Orders.FindAsync(id) is Order o ? Results.Ok(o) : Results.NotFound())
   .WithName("GetOrder");

app.Run();

public record Order(int Id, string Customer, string City, string State, decimal Total);

public class StoreDb(DbContextOptions<StoreDb> options) : DbContext(options)
{
    public DbSet<Order> Orders => Set<Order>();
}

And the final project file, two packages lighter on worries:

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.14" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.14" />
  </ItemGroup>

</Project>

The build is clean again:

  UsStoreOrders -> C:\DotNetDemo\UpgradeDemo\UsStoreOrders\bin\Debug\net10.0\UsStoreOrders.dll
Build succeeded.
    0 Warning(s)
    0 Error(s)

Other Breaking Changes in .NET 9 and .NET 10 to Check

Jumping from .NET 8 to .NET 10 means you take the .NET 9 changes too. My demo didn’t hit these, but they’re on Microsoft’s breaking-change lists, and real apps do:

If you serialize your own JSON, also test payloads carefully; I covered serializer quirks in converting an object to JSON without escape characters.

Step 6: Run the Upgraded App on .NET 10

Same commands as Step 1, same requests, new runtime. The only difference in the output is the OpenAPI URL, since the built-in document lives at /openapi/v1.json:

dotnet --version
curl -s -w "\n" http://localhost:5280/about
curl -s -w "\n" http://localhost:5280/orders/1001
curl -s -o NUL -w "openapi/v1.json: %{http_code}\n" http://localhost:5280/openapi/v1.json

Output:

10.0.402
{"runtime":".NET 10.0.13","target":".NETCoreApp,Version=v10.0"}
{"id":1001,"customer":"Jenna Moore","city":"Austin","state":"TX","total":249.99}
openapi/v1.json: 200

FrameworkDescription went from .NET 8.0.33 to .NET 10.0.13, and the order data is identical. The built-in document also reports "openapi": "3.1.1", since .NET 10 generates OpenAPI 3.1 by default. I list other changes in what is new in .NET 10.

The project also compiles as C# 14 now. Nothing in my code needed it, but features like the field keyword are free to use; see the new features in C# 14.

How Do You Update Docker Images and CI for .NET 10?

Your code isn’t the only place that names .NET 8. Search the repo for 8.0 and update Dockerfiles and pipelines. Here’s a Dockerfile snippet for this project with the .NET 10 tags (I didn’t build the image on this PC):

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src
COPY . .
RUN dotnet publish UsStoreOrders/UsStoreOrders.csproj -c Release -o /app

FROM mcr.microsoft.com/dotnet/aspnet:10.0
WORKDIR /app
COPY --from=build /app .
ENTRYPOINT ["dotnet", "UsStoreOrders.dll"]

Watch the base OS. The default .NET 10 tags use Ubuntu 24.04 “Noble” instead of Debian, and Microsoft doesn’t ship Debian images for .NET 10. If your Dockerfile runs apt-get, test it again.

For GitHub Actions, bump the SDK in actions/setup-dotnet. Pointing it at global.json keeps CI and your machine on the same SDK:

- uses: actions/setup-dotnet@v4
  with:
    dotnet-version: '10.0.x'
    # or: global-json-file: global.json

Azure DevOps works the same way with the UseDotNet@2 task. If you deploy to Azure, my AI and Azure .NET tutorials cover the hosting side.

Can a Tool Upgrade .NET 8 to .NET 10 for You?

Partly. The .NET Upgrade Assistant is officially deprecated now. Microsoft points you to the GitHub Copilot modernization chat agent instead, which comes with Visual Studio 2026 and Visual Studio 2022 17.14.16 or later.

The agent analyzes your projects and dependencies, builds a step-by-step plan, and commits each change so you can roll back. For a project this size, I’d still do it by hand; it’s five edits, and you learn where your risks are.

On big solutions with dozens of projects, the agent saves real time. Just review every commit, the same way you’d review a teammate’s pull request. Upgrade questions like this also come up in .NET Core interview questions.

My .NET 8 to .NET 10 Upgrade Checklist

Here’s the order I’d follow on any ASP.NET Core 8 app:

1. Build and run on .NET 8, and save sample responses.
2. Install the .NET 10 SDK and update global.json.
3. Change net8.0 to net10.0 in every project.
4. Run dotnet list package --outdated and update Microsoft packages to 10.0.x.
5. Update or replace third-party packages that depend on old Microsoft libraries, like Swashbuckle 6.x.
6. Fix warnings such as ASPDEPR002, then run the app and your tests.
7. Update Dockerfiles, CI and hosting to .NET 10.

Compare the responses from step 1 with the new ones before you deploy. All the .NET release posts live on my .NET versions hub.

If you’re still getting comfortable with the language side of .NET, these are worth a read:

• Create a console app in VS Code
• What C# is and what it’s used for
• C# interview questions for experienced developers

Frequently Asked Questions

Bijay Kumar

Bijay Kumar is a renowned software engineer, accomplished author, and distinguished Microsoft Most Valuable Professional (MVP) specializing in SharePoint. With a rich professional background spanning over 15 years, Bijay has established himself as an authority in the field of information technology. He possesses unparalleled expertise in multiple programming languages and technologies such as ASP.NET, ASP.NET MVC, C#.NET, and SharePoint, which has enabled him to develop innovative and cutting-edge solutions for clients across the globe. Read more…

aspdotnethelp.com

So, what’s new in .NET 10? You can run a single .cs file with dotnet run app.cs, write C# 14, validate Minimal API input with one line, stream server-sent events, and serve OpenAPI 3.1 as YAML.

In this tutorial, I’ll test what’s new in .NET 10 feature by feature. Each section has a small program, the real output, and a short “How does this code work?” walk-through, so you can judge what’s worth adopting.

My setup is Windows 11, VS Code, and .NET SDK 10.0.402 (runtime 10.0.13). Most demos are single-file apps, so you can copy one file into an empty folder and run it.

.NET 10 at a Glance: Release Date, LTS Support and Key Features

Here’s the short version before we get into code. I’ve grouped the changes a working C# or web developer will actually notice:

Support is the other half of the story. Microsoft supports an LTS release for three years, and two older versions retire on the same day this November (my .NET versions and support dates page tracks every release):

As I write this on October 26, 2026, that’s just 15 days away. My guide to .NET 8 and .NET 9 end of support covers what that date means for your apps, and you can check which .NET version is installed before you start.

Feature 1: File-Based Apps Run a Single .cs File in .NET 10

This is the change I use most. A .NET 10 SDK can build and run one C# file with no .csproj, no Program class, and no solution. Directives at the top of the file replace the project settings.

Here’s a small script that pulls in a NuGet package with #:package and prints where it’s running from:

#:package Humanizer@3.0.10
using Humanizer;

Console.WriteLine("order_shipped_to_dallas".Humanize());
Console.WriteLine(TimeSpan.FromMinutes(95).Humanize(2));
Console.WriteLine(DateTime.UtcNow.AddHours(-3).Humanize());
Console.WriteLine($"Running {AppContext.GetData("EntryPointFilePath")}");

Output:

order shipped to dallas
1 hour, 35 minutes
3 hours ago
Running C:\DotNetDemo\Net10Demo\Hello.cs

How does this code work?

• #:package Humanizer@3.0.10 adds a NuGet reference, exactly like a PackageReference in a project. Other directives are #:sdk, #:property and #:project.
• dotnet run Hello.cs creates a hidden virtual project, restores, builds and runs it. The build output goes to a temp folder, not next to your file.
• AppContext.GetData("EntryPointFilePath") returns the path of the running file, which is handy for scripts that read files beside them.

One gotcha caught me right away. File-based apps target native AOT by default, so reflection-based System.Text.Json is switched off. My first JSON demo crashed with this message:

Unhandled exception. System.InvalidOperationException: Reflection-based serialization has been disabled for this application. Either use the source generator APIs or explicitly configure the 'JsonSerializerOptions.TypeInfoResolver' property.

The fix is one line at the top of the file: #:property PublishAot=false. You’ll see it in the web and JSON demos below. Keep AOT on when you plan to dotnet publish app.cs to a small native executable.

When a script grows up, dotnet project convert Hello.cs turns it into a normal project. It created a Hello folder with a copy of the code (directives removed) and this project file:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net10.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
    <PublishAot>true</PublishAot>
    <PackAsTool>true</PackAsTool>
    <UserSecretsId>Hello-580d788577a6cb5a279acf621b27d3108617e2bb7a00b143197ab430d3b18907</UserSecretsId>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Humanizer" Version="3.0.10" />
  </ItemGroup>

</Project>

From there it’s a regular console project, the same kind I set up in my guide to create a console application in VS Code.

Feature 2: C# 14 Comes With .NET 10

Every .NET 10 project compiles as C# 14 by default. Three features show up in my code almost every day: the field keyword, extension members, and null-conditional assignment.

var order = new Order { Customer = "  Chloe Brady  " };
Console.WriteLine($"[{order.Customer}]");

Order? missing = null;
missing?.Customer = "Nobody";        // null-conditional assignment
Console.WriteLine($"missing is still {missing?.ToString() ?? "null"}");

decimal total = 1249.5m;
Console.WriteLine(total.AsUsd);       // extension property

class Order
{
    public string Customer { get; set => field = value.Trim(); } = "";
}

static class MoneyExtensions
{
    extension(decimal amount)
    {
        public string AsUsd => amount.ToString("C", new System.Globalization.CultureInfo("en-US"));
    }
}

Output:

[Chloe Brady]
missing is still null
$1,249.50

How does this code work?

set => field = value.Trim(); uses the compiler’s backing field, so you can add logic to one accessor without declaring a private field.

missing?.Customer = "Nobody"; only assigns when missing isn’t null. Before C# 14, you’d write an if check first.

The extension(decimal amount) block adds an AsUsd property to decimal. Older extension methods couldn’t add properties at all.

There’s more: implicit span conversions, nameof(List<>), partial constructors and user-defined compound operators. I walk through each one in what is new in C# 14, and the null-conditional change pairs well with these ways to check for null in C#.

Feature 3: Built-In Minimal API Validation in ASP.NET Core 10

Until .NET 10, Minimal APIs ignored [Required] and [Range], so you wrote checks by hand or added a library (more web examples live in my ASP.NET Core tutorials). Now one call, builder.Services.AddValidation(), validates query strings, headers and request bodies.

This file-based web app starts Kestrel, posts a good order and a bad one to itself, prints both responses, and stops:

#:sdk Microsoft.NET.Sdk.Web
#:property PublishAot=false
using System.ComponentModel.DataAnnotations;

var builder = WebApplication.CreateBuilder();
builder.Logging.ClearProviders();
builder.Services.AddValidation();
var app = builder.Build();
app.MapPost("/orders", (Order o) => TypedResults.Created($"/orders/{o.Id}", o));
app.Urls.Add("http://localhost:5187");
await app.StartAsync();

using var http = new HttpClient { BaseAddress = new("http://localhost:5187") };
string[] bodies = ["""{"id":1,"customer":"Jenna Moore","state":"TX","quantity":3}""",
                   """{"id":2,"customer":"","state":"Texas","quantity":0}"""];
foreach (var body in bodies)
{
    var res = await http.PostAsync("/orders", new StringContent(body, null, "application/json"));
    Console.WriteLine($"{(int)res.StatusCode} {await res.Content.ReadAsStringAsync()}");
}
await app.StopAsync();

public record Order(int Id, [Required] string Customer,
    [StringLength(2, MinimumLength = 2)] string State, [Range(1, 100)] int Quantity);

Output:

201 {"id":1,"customer":"Jenna Moore","state":"TX","quantity":3}
400 {"title":"One or more validation errors occurred.","errors":{"Customer":["The Customer field is required."],"State":["The field State must be a string with a minimum length of 2 and a maximum length of 2."],"Quantity":["The field Quantity must be between 1 and 100."]}}

How does this code work?

• #:sdk Microsoft.NET.Sdk.Web turns the single file into an ASP.NET Core app. That’s the same SDK a web .csproj uses.
• AddValidation() registers a source-generated validator for the Order record. It reads the DataAnnotations attributes on the record’s parameters.
• The first order passes and returns 201. The second fails three rules, so ASP.NET Core returns 400 with an errors object keyed by property name.

Need an endpoint to skip it? Add .DisableValidation() to that route. This topic comes up a lot in interviews now, so it’s worth adding to your .NET Core interview questions prep.

Feature 4: Server-Sent Events With TypedResults.ServerSentEvents

Server-sent events (SSE) push a one-way stream of updates over plain HTTP. They’re a lighter option than SignalR for dashboards, stock tickers or progress bars. ASP.NET Core 10 adds TypedResults.ServerSentEvents, so you just return an async stream:

#:sdk Microsoft.NET.Sdk.Web
#:property PublishAot=false

var builder = WebApplication.CreateBuilder();
builder.Logging.ClearProviders();
var app = builder.Build();
app.Urls.Add("http://localhost:5188");

app.MapGet("/prices", () => TypedResults.ServerSentEvents(Prices(), eventType: "price"));

await app.StartAsync();
using var http = new HttpClient { BaseAddress = new("http://localhost:5188") };
Console.Write(await http.GetStringAsync("/prices"));
await app.StopAsync();

static async IAsyncEnumerable<Quote> Prices()
{
    foreach (var (symbol, usd) in new[] { ("MSFT", 512.40m), ("NVDA", 188.15m), ("AAPL", 254.30m) })
    {
        await Task.Delay(200);
        yield return new Quote(symbol, usd);
    }
}

record Quote(string Symbol, decimal Usd);

Output:

event: price
data: {"symbol":"MSFT","usd":512.40}

event: price
data: {"symbol":"NVDA","usd":188.15}

event: price
data: {"symbol":"AAPL","usd":254.30}

How does this code work?

Prices() is an IAsyncEnumerable<Quote> that yields three quotes, 200 ms apart.

TypedResults.ServerSentEvents(Prices(), eventType: "price") writes each item as an event: line plus a JSON data: line, with a blank line between events.

In a browser, you’d read the same stream with JavaScript’s EventSource and listen for the price event.

The foreach (var (symbol, usd) in ...) loop deconstructs each pair, which I explain in my guide to tuples in C#.

Feature 5: OpenAPI 3.1 and YAML Documents in .NET 10

The built-in OpenAPI generator now writes OpenAPI 3.1 by default, and it can serve the document as YAML. You only change the route passed to MapOpenApi:

#:sdk Microsoft.NET.Sdk.Web
#:package Microsoft.AspNetCore.OpenApi@10.0.13
#:property PublishAot=false

var builder = WebApplication.CreateBuilder();
builder.Logging.ClearProviders();
builder.Services.AddOpenApi();
var app = builder.Build();
app.Urls.Add("http://localhost:5189");
app.MapOpenApi("/openapi/{documentName}.yaml");
app.MapGet("/stores/{state}", (string state, int? limit) => new[] { "Austin", "Dallas" });

await app.StartAsync();
using var http = new HttpClient { BaseAddress = new("http://localhost:5189") };
Console.WriteLine(await http.GetStringAsync("/openapi/v1.yaml"));
await app.StopAsync();

Output:

openapi: '3.1.1'
info:
  title: OpenApiYaml | v1
  version: 1.0.0
servers:
  - url: http://localhost:5189/
paths:
  '/stores/{state}':
    get:
      tags:
        - OpenApiYaml
      parameters:
        - name: state
          in: path
          required: true
          schema:
            type: string
        - name: limit
          in: query
          schema:
            pattern: '^-?(?:0|[1-9]\d*)$'
            type:
              - integer
              - string
            format: int32
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
tags:
  - name: OpenApiYaml

How does this code work?

AddOpenApi() plus MapOpenApi("/openapi/{documentName}.yaml") serves the document as YAML because the route ends in .yaml.

The output starts with openapi: '3.1.1'. Older releases produced OpenAPI 3.0.

The nullable int? limit shows up as a JSON Schema type array instead of the old nullable: true flag.

With version 10.0.0 of the package, restore warned about a known vulnerability in Microsoft.OpenApi 2.0.0. Pinning the current 10.0.x patch made it go away. If nullable types are new to you, my post on C# data types covers them.

Feature 6: Stricter JSON in .NET 10 With JsonSerializerOptions.Strict

By default, System.Text.Json quietly takes the last value when a property appears twice. That’s a real security risk for payment or permission fields. .NET 10 adds AllowDuplicateProperties and a ready-made JsonSerializerOptions.Strict preset:

#:property PublishAot=false
using System.Text.Json;

string json = """{ "Customer": "Ryan Carter", "Total": 49.99, "Total": 0.01 }""";
var loose = JsonSerializer.Deserialize<Invoice>(json)!;
Console.WriteLine($"Default: Total = {loose.Total}");

try { JsonSerializer.Deserialize<Invoice>(json, JsonSerializerOptions.Strict); }
catch (JsonException ex) { Console.WriteLine($"Strict:  {ex.Message}"); }

string extra = """{ "Customer": "Ryan Carter", "Total": 49.99, "Coupon": "FALL26" }""";
try { JsonSerializer.Deserialize<Invoice>(extra, JsonSerializerOptions.Strict); }
catch (JsonException ex) { Console.WriteLine($"Strict:  {ex.Message}"); }

record Invoice(string Customer, decimal Total);

Output:

Default: Total = 0.01
Strict:  Duplicate property 'Total' encountered during deserialization of type 'Invoice'.
Strict:  The JSON property 'Coupon' could not be mapped to any .NET member contained in type 'Invoice'.

How does this code work?

• The default deserializer reads Total twice and keeps 0.01. Imagine that on a $49.99 invoice.
• JsonSerializerOptions.Strict disallows duplicate properties and unmapped members, keeps case-sensitive binding, and respects nullable annotations and required constructor parameters.
• Each violation throws JsonException with a clear message, so you can return a 400 instead of saving bad data.

I catch the error with a normal try-catch block in C#. For the writing side of JSON, see how to convert an object to JSON without escape characters.

Feature 7: New .NET 10 Library APIs You Can Use Today

The libraries got dozens of additions, from post-quantum cryptography to async ZIP APIs. These three solve problems I’ve hit in real business code:

using System.Globalization;

var numeric = StringComparer.Create(CultureInfo.GetCultureInfo("en-US"), CompareOptions.NumericOrdering);
string[] ids = ["INV-10", "INV-2", "INV-1"];
Console.WriteLine("Ordinal: " + string.Join(", ", ids.Order(StringComparer.Ordinal)));
Console.WriteLine("Numeric: " + string.Join(", ", ids.Order(numeric)));

var stock = new OrderedDictionary<string, int> { ["Austin"] = 4 };
foreach (var city in new[] { "Denver", "Austin" })
    if (!stock.TryAdd(city, 1, out int i))
        stock.SetAt(i, stock.GetAt(i).Value + 1);
Console.WriteLine(string.Join(", ", stock.Select(kv => $"{kv.Key}={kv.Value}")));

var thanksgiving = new DateOnly(2026, 11, 26);
Console.WriteLine($"Thanksgiving 2026 is in ISO week {ISOWeek.GetWeekOfYear(thanksgiving)}");

Output:

Ordinal: INV-1, INV-10, INV-2
Numeric: INV-1, INV-2, INV-10
Austin=5, Denver=1
Thanksgiving 2026 is in ISO week 48

How does this code work?

CompareOptions.NumericOrdering compares digits as numbers, so INV-2 sorts before INV-10. An ordinal sort puts INV-10 second.

The new TryAdd(key, value, out int index) overload returns the existing entry’s index when the key is taken, so SetAt updates it without a second lookup.

ISOWeek.GetWeekOfYear now accepts DateOnly. Thanksgiving 2026 (November 26) lands in ISO week 48.

Numeric ordering removes the need for a custom comparer when you sort an array in C#. If OrderedDictionary is new to you, start with the basics of the Dictionary in C#.

Feature 8: .NET 10 SDK and CLI Changes

A few SDK changes don’t need a demo file, but they change daily habits. Here’s what I verified in the .NET 10 SDK notes:

On my machine the SDK installed dnx.cmd right next to dotnet.exe in C:\Program Files\dotnet. Older SDKs don’t have it, so run dotnet --version first. Tooling questions like these also show up in C# interview questions for experienced developers.

What Else Is New in .NET 10 for ASP.NET Core and Blazor?

Not everything fits in a single-file demo. These are the other ASP.NET Core 10 and platform changes I’d read about before a project kicks off:

The cookie change matters most if your SPA used to get a login page back instead of a 401. If you’re building sign-in today, passkeys are worth a look before you add a one-time code flow like this OTP generator in ASP.NET.

Should You Upgrade to .NET 10 Now?

Yes, for nearly everyone. .NET 8 and .NET 9 both lose support on November 10, 2026, and .NET 10 is covered until November 14, 2028. Changing net8.0 to net10.0 is usually the easy part; package updates and breaking changes take the time.

I list every step, from global.json to Docker images, in my guide to upgrade .NET 8 to .NET 10. Start with file-based apps for scripts, AddValidation() for Minimal APIs, and JsonSerializerOptions.Strict anywhere money changes hands.

If you’re picking up .NET 10 alongside the basics, these are good next reads:

• What is C# and what it’s used for
• Working with a List in C#
• Interfaces in C#, explained with examples

Frequently Asked Questions

Bijay Kumar

Bijay Kumar is a renowned software engineer, accomplished author, and distinguished Microsoft Most Valuable Professional (MVP) specializing in SharePoint. With a rich professional background spanning over 15 years, Bijay has established himself as an authority in the field of information technology. He possesses unparalleled expertise in multiple programming languages and technologies such as ASP.NET, ASP.NET MVC, C#.NET, and SharePoint, which has enabled him to develop innovative and cutting-edge solutions for clients across the globe. Read more…

aspdotnethelp.com

In this tutorial, I’ll break down what .NET 8 end of support means in practice, who’s affected, the full version timeline, the Azure Functions deadline that lands the same day, and the short path to .NET 10.

.NET 8 and .NET 9 End of Support Dates at a Glance

Here’s the timeline from Microsoft’s .NET support policy, with the status as of today, October 26, 2026. My .NET versions and support dates page tracks every release:

I like having the countdown in code, so here’s a tiny .NET 10 file-based app. It stores the dates in a C# Dictionary and subtracts DateOnly.DayNumber values:

using System.Globalization;
using System.Runtime.InteropServices;

CultureInfo.CurrentCulture = new("en-US");
var today = new DateOnly(2026, 10, 26);   // fixed "today"
var ends = new Dictionary<string, DateOnly>
{
    [".NET 8 (LTS)"] = new(2026, 11, 10),
    [".NET 9 (STS)"] = new(2026, 11, 10),
    [".NET 10 (LTS)"] = new(2028, 11, 14),
};

Console.WriteLine($"Runtime: {RuntimeInformation.FrameworkDescription}");
foreach (var (version, end) in ends)
{
    int days = end.DayNumber - today.DayNumber;
    Console.WriteLine($"{version,-14} {end:MMM d, yyyy}: {days} days left");
}

Output:

Runtime: .NET 10.0.13
.NET 8 (LTS)   Nov 10, 2026: 15 days left
.NET 9 (STS)   Nov 10, 2026: 15 days left
.NET 10 (LTS)  Nov 14, 2028: 750 days left

DayNumber turns each date into a plain day count, so the subtraction can’t trip over month lengths. I use the same idea for start and end dates of a month in C#.

What Does .NET 8 End of Support Actually Mean?

Microsoft defines end of support as the date after which it no longer provides fixes, updates or technical assistance. In practice, that’s four things:

• No security patches. .NET servicing updates ship monthly, and security fixes land on Patch Tuesday (the second Tuesday). After November 10, .NET 8 and .NET 9 get none.
• One possible last update. November 10 is itself a Patch Tuesday, so each version may get a final update that day, but only for a known critical issue.
• No Microsoft support. You can’t open a support case for an out-of-support runtime.
• Your apps keep running. Nothing gets switched off. The risk is the next vulnerability that never gets patched.

Visual Studio 2022 will mark the .NET 8 and .NET 9 components as out of support in a future servicing update. Existing installs aren’t affected, though the installer can remove out-of-support components.

On Azure App Service, apps on an end-of-support runtime continue to run unchanged. But App Service can’t provide security patches or support for that runtime until you upgrade.

Compliance is the part that bites first. Vulnerability scanners and auditors usually flag unsupported runtimes, so expect questions in your next security review. It’s also a common topic in .NET Core interview questions.

Why Do .NET 8 and .NET 9 End Support on the Same Day?

Releases alternate between Long Term Support and Standard Term Support. LTS versions get at least three years of patches. STS versions used to get 18 months, but Microsoft extended STS to 24 months in late 2025.

That extension moved .NET 9 from May 2026 to November 2026, right on top of .NET 8. End dates also snap to Patch Tuesday, which is why it’s November 10 rather than a release anniversary.

So there’s no point hopping from .NET 8 to .NET 9 now. Go straight to .NET 10 and you get support until 2028, plus everything in what is new in .NET 10.

Who Is Affected by .NET 8 and .NET 9 End of Support?

If any of these describe your work, the November 10 date applies to you:

• Apps whose project files target net8.0 or net9.0, whether framework-dependent or self-contained.
• Docker images built on the 8.0 or 9.0 runtime tags.
• Web apps on Azure App Service using the .NET 8 or .NET 9 stack.
• Azure Functions on the in-process model (covered below).
• Third-party tools built on .NET 8 or 9. Ask the vendor for a .NET 10 build.

.NET Framework 4.8 isn’t part of this. It follows a separate lifecycle tied to the Windows version it ships with.

How to Check Which .NET Version You’re Running

Start with the machine. dotnet --version shows the SDK the CLI picks, and dotnet --list-runtimes lists every installed runtime. My full guide to checking the .NET version covers Visual Studio, the registry and code too.

Here’s what my demo machine prints for the runtimes:

dotnet --list-runtimes
Microsoft.AspNetCore.App 6.0.24 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.24 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.24 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 10.0.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Then check the code. Search your repos for <TargetFramework>net8.0 and net9.0, including TargetFrameworks with an s for multi-targeted libraries. Don’t forget CI pipelines and Dockerfiles that pin an SDK or image version.

For a build-time alarm, set the CheckSdkVulnerabilities MSBuild property to true. The build then warns with NETSDK1239 when the resolved SDK is end of life.

Azure Functions In-Process Model Support Also Ends November 10, 2026

This one’s easy to miss. Support for the Azure Functions in-process model ends on the same day, and Microsoft’s answer is to migrate C# function apps to the isolated worker model on .NET 10.

The migration touches more than the target framework. Here are the main changes from the Microsoft Learn migration guide:

1. Set the project SDK to Azure.Functions.Sdk and TargetFramework to net10.0.
2. Replace Microsoft.NET.Sdk.Functions and any Microsoft.Azure.WebJobs.* packages with Microsoft.Azure.Functions.Worker packages.
3. Add a Program.cs that builds the host; it replaces your FunctionsStartup class.
4. Rename [FunctionName] to [Function] and get ILogger<T> through the constructor.
5. Set FUNCTIONS_WORKER_RUNTIME to dotnet-isolated, then deploy through a staging slot and swap.

Locally, that last setting lives in local.settings.json:

{
    "IsEncrypted": false,
    "Values": {
        "AzureWebJobsStorage": "UseDevelopmentStorage=true",
        "FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated"
    }
}

Watch the JSON, too. The isolated model uses System.Text.Json, which ignores Newtonsoft attributes like [JsonProperty]. I covered its options in serializing objects to JSON in C#.

How to Move from .NET 8 or .NET 9 to .NET 10

For most apps, the upgrade is a short checklist. I’ll keep it brief here; the step-by-step version with real errors and fixes is in my guide to upgrading .NET 8 to .NET 10.

1. Install the .NET 10 SDK and pin it with global.json so every developer and build agent uses the same one.
2. Change TargetFramework from net8.0 or net9.0 to net10.0.
3. Update Microsoft.* packages (EF Core, ASP.NET Core, Extensions) to 10.x; dotnet list package --outdated shows what’s behind.
4. Build, run your tests and read the .NET 10 breaking changes for the areas you use.
5. Update hosting: the App Service stack, Docker base images and CI pipeline SDK versions.
6. Deploy to staging first, then production.

Pin the SDK with global.json

This global.json asks for SDK 10.0.100 or any later 10.0 feature band, so the CLI won’t silently fall back to an older SDK:

{
  "sdk": {
    "version": "10.0.100",
    "rollForward": "latestFeature"
  }
}

Running dotnet --version and dotnet --list-sdks in that folder confirms the pick:

dotnet --version
10.0.402

dotnet --list-sdks
7.0.403 [C:\Program Files\dotnet\sdk]
10.0.402 [C:\Program Files\dotnet\sdk]

Change the TargetFramework to net10.0

Here’s a small console project after the change. The comment marks where net8.0 used to be. If you’re new to project-based apps, see creating a console app in VS Code.

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <!-- was net8.0: .NET 8 support ends November 10, 2026 -->
    <TargetFramework>net10.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>

</Project>

And the Program.cs that proves which runtime it lands on:

using System.Runtime.InteropServices;

Console.WriteLine($"Framework: {RuntimeInformation.FrameworkDescription}");
Console.WriteLine($"Runtime version: {Environment.Version}");
Console.WriteLine($"Target: {AppContext.TargetFrameworkName}");

Running dotnet run --project OrdersApp prints:

Framework: .NET 10.0.13
Runtime version: 10.0.13
Target: .NETCoreApp,Version=v10.0

AppContext.TargetFrameworkName confirms the build target, while Environment.Version shows the runtime patch. With .NET 10 you also get C# 14 by default; see what is new in C# 14.

Which .NET 8 End of Support Plan Should You Pick?

With 15 days left, here’s how I’d triage:

Whatever you pick, log errors well during the cutover.

Once you’re on .NET 10, these are good next reads:

• What C# is and how it fits with .NET 10
• Handling errors with try-catch in C#
• All C# and .NET tutorials
• ASP.NET Core tutorials

Frequently Asked Questions

Bijay Kumar

Bijay Kumar is a renowned software engineer, accomplished author, and distinguished Microsoft Most Valuable Professional (MVP) specializing in SharePoint. With a rich professional background spanning over 15 years, Bijay has established himself as an authority in the field of information technology. He possesses unparalleled expertise in multiple programming languages and technologies such as ASP.NET, ASP.NET MVC, C#.NET, and SharePoint, which has enabled him to develop innovative and cutting-edge solutions for clients across the globe. Read more…

aspdotnethelp.com

In this tutorial, I’ll answer 40 .NET Core interview questions with short answers first, then the detail an interviewer wants to hear. Each group is labeled Junior, Mid or Senior.

For the trickiest ones, like DI lifetimes and middleware order, I ran a small .NET 10 program so you can see the proof, not just my word for it.

.NET Platform Interview Questions (Junior)

Q1. What is .NET Core, and what is it called now? (Junior)

Short answer: .NET Core was the cross-platform, open-source rewrite of .NET. Starting with .NET 5, Microsoft dropped “Core” from the name, so today it’s just .NET, and the current long-term release is .NET 10.

ASP.NET Core and EF Core kept “Core,” so job posts still use it. C# is the main language on top of it; if you need a refresher, my article on what C# is and how it runs on .NET covers the basics.

Q2. What’s the difference between .NET and .NET Framework? (Junior)

Short answer: .NET Framework 4.8.x is Windows-only and only gets fixes. Modern .NET runs on Windows, Linux and macOS, ships a new version every November and is where every new feature lands.

.NET Standard 2.0 only matters now for a library that must serve both a .NET Framework 4.8 app and a .NET 10 app. There won’t be a new .NET Standard version.

If a team asks why they should migrate, I’d say performance, Linux hosting costs and support for new C# versions. Web Forms and WCF server don’t exist in .NET 10, so those parts need a rewrite.

Q3. What do LTS and STS mean, and which .NET version should you use in 2026? (Junior)

Short answer: LTS (long-term support) releases get three years of free patches, STS (standard-term support) releases get two. In 2026, new projects should target .NET 10, the current LTS.

Here’s a detail that impresses interviewers: .NET 8 and .NET 9 both reach end of support on November 10, 2026. Even-numbered releases are LTS, and the last six months of any release are security-fixes only.

Q4. Which .NET CLI commands should you know? (Junior)

Short answer: dotnet new, dotnet build, dotnet run, dotnet test, dotnet publish and dotnet add package. In .NET 10 you can also run a single file with dotnet run app.cs.

I used that single-file feature for the demos here. A #:package line at the top pulls a NuGet package, and #:sdk Microsoft.NET.Sdk.Web turns the file into a web app. For a full project setup, see how to create a console application in Visual Studio Code.

Runtime Interview Questions: CLR, JIT, GC and Native AOT (Junior to Mid)

Q5. What does the CLR do? (Junior)

Short answer: The Common Language Runtime loads your compiled IL, JIT-compiles it to machine code, manages memory with the garbage collector, and enforces type safety and exception handling.

Questions about value and reference types usually follow. Be ready to explain boxing and unboxing in C#, because it’s where the CLR’s two memory models meet.

Q6. What’s the difference between JIT, ReadyToRun and Native AOT? (Mid)

Short answer: JIT compiles IL to machine code at run time. ReadyToRun precompiles most code but keeps the JIT. Native AOT compiles everything ahead of time into one native executable with no JIT at all.

Native AOT gives faster startup and lower memory, which is great for containers and serverless. The trade-off is no runtime reflection or dynamic code, so minimal APIs work (partially), but MVC controllers, Razor Pages, session state and Blazor Server don’t.

Q7. How does the garbage collector work, and where does IDisposable fit? (Mid)

Short answer: The GC frees managed memory in generations (0, 1 and 2, plus the large object heap). It doesn’t close files, sockets or database connections on time, so those types implement IDisposable and you wrap them in using.

Interviewers love the follow-up about finalizers. My guide to Dispose and Finalize in C# shows the full pattern and why you rarely write a finalizer yourself.

Q8. What’s the difference between framework-dependent and self-contained deployment? (Mid)

Short answer: A framework-dependent app needs the .NET runtime installed on the server and is small. A self-contained app ships its own runtime, so it’s bigger but runs on a machine with nothing installed.

You pick it at publish time, for example dotnet publish -c Release -r linux-x64 --self-contained. Native AOT is a third option that’s always self-contained.

Dependency Injection Interview Questions (Mid)

Q9. What is dependency injection in ASP.NET Core? (Junior)

Short answer: A class asks for what it needs through its constructor, and the built-in container (IServiceProvider) creates and passes those objects in. You register services on builder.Services in Program.cs.

It works best when a class depends on an abstraction, so you can swap the real thing for a fake in tests. That’s why every DI answer leads back to interfaces in C#.

Constructor injection is the default, and C# 12 primary constructors make it shorter. If constructors are fuzzy, review constructors in C# before the interview.

Q10. What’s the difference between AddSingleton, AddScoped and AddTransient? (Mid)

Short answer: Singleton: one instance for the whole app. Scoped: one instance per scope, which in ASP.NET Core means per HTTP request. Transient: a new instance every time it’s requested.

This is the most-asked ASP.NET Core question, so I proved it. The program below resolves each service twice inside two scopes, which is exactly what two HTTP requests look like to the container:

#:package Microsoft.Extensions.DependencyInjection@10.0.13
using Microsoft.Extensions.DependencyInjection;

var services = new ServiceCollection();
services.AddSingleton<PricingRules>();
services.AddScoped<ShoppingCart>();
services.AddTransient<TaxCalculator>();
using var root = services.BuildServiceProvider();

for (int request = 1; request <= 2; request++)
{
    using var scope = root.CreateScope();   // = one HTTP request
    Console.WriteLine($"Request {request}");
    Show<PricingRules>(scope.ServiceProvider);
    Show<ShoppingCart>(scope.ServiceProvider);
    Show<TaxCalculator>(scope.ServiceProvider);
}

static void Show<T>(IServiceProvider sp) where T : IHasId =>
    Console.WriteLine($"  {typeof(T).Name,-14} #{sp.GetRequiredService<T>().Id}  #{sp.GetRequiredService<T>().Id}");

interface IHasId { int Id { get; } }
class Counted<T> : IHasId { static int count; public int Id { get; } = ++count; }
class PricingRules : Counted<PricingRules>;
class ShoppingCart : Counted<ShoppingCart>;
class TaxCalculator : Counted<TaxCalculator>;

Output:

Request 1
  PricingRules   #1  #1
  ShoppingCart   #1  #1
  TaxCalculator  #1  #2
Request 2
  PricingRules   #1  #1
  ShoppingCart   #2  #2
  TaxCalculator  #3  #4

PricingRules stays #1 everywhere. ShoppingCart is #1 twice in request 1 and #2 twice in request 2. TaxCalculator gets a new number on every call, #1 through #4.

Q11. What is a captive dependency, and how do you catch it? (Senior)

Short answer: A captive dependency is a longer-lived service holding a shorter-lived one, usually a singleton that takes a scoped DbContext in its constructor. The scoped object then lives forever and is shared across requests.

#:package Microsoft.Extensions.DependencyInjection@10.0.13
using Microsoft.Extensions.DependencyInjection;

var services = new ServiceCollection();
services.AddScoped<OrderDbContext>();
services.AddSingleton<PriceCache>();    // singleton asks for scoped

using var loose = services.BuildServiceProvider();
using var s1 = loose.CreateScope();
using var s2 = loose.CreateScope();
int a = s1.ServiceProvider.GetRequiredService<PriceCache>().Db.Id;
int b = s2.ServiceProvider.GetRequiredService<PriceCache>().Db.Id;
Console.WriteLine($"No validation: scope 1 DbContext #{a}, scope 2 #{b}");

using var strict = services.BuildServiceProvider(validateScopes: true);
try { strict.GetRequiredService<PriceCache>(); }
catch (InvalidOperationException ex) { Console.WriteLine(ex.Message); }

class OrderDbContext { static int count; public int Id { get; } = ++count; }
class PriceCache(OrderDbContext db) { public OrderDbContext Db => db; }

Output:

No validation: scope 1 DbContext #1, scope 2 #1
Cannot consume scoped service 'OrderDbContext' from singleton 'PriceCache'.

Without validation, both scopes got DbContext #1, which is a thread-safety bug waiting to happen. With validateScopes: true, the container threw “Cannot consume scoped service ‘OrderDbContext’ from singleton ‘PriceCache’.”

ASP.NET Core turns scope validation on in the Development environment, so you’ll usually see this at startup. The fix is to inject IServiceScopeFactory into the singleton and create a scope when you need the DbContext.

Q12. What are keyed services? (Mid)

Short answer: Added in .NET 8, keyed services let you register several implementations of one interface under different keys, then pick one with [FromKeyedServices("key")].

For example, AddKeyedSingleton<IShippingRates, UpsRates>("ups") and another for “fedex”. Before .NET 8 you’d write a factory or inject IEnumerable<T> and filter it.

Middleware Pipeline Interview Questions (Mid)

Q13. What is middleware, and what’s the difference between Use, Run and Map? (Junior)

Short answer: Middleware is a component in the request pipeline that can handle a request, change it, and call the next one. Use calls next, Run ends the pipeline, and Map branches it by path.

Each piece is a RequestDelegate, so knowing delegates in C# makes the whole model click.

Q14. Does middleware order matter? Prove it. (Mid)

Short answer: Yes. Middleware runs top to bottom on the way in and bottom to top on the way out, so the first one registered sees the request first and the response last.

I ran a real minimal API in memory with TestServer, no port needed, and logged each step:

#:sdk Microsoft.NET.Sdk.Web
#:package Microsoft.AspNetCore.TestHost@10.0.13
using Microsoft.AspNetCore.TestHost;

var builder = WebApplication.CreateBuilder();
builder.WebHost.UseTestServer();      // in-memory server, no port
builder.Logging.ClearProviders();
var app = builder.Build();

app.Use(Step("1 RequestTimer"));
app.Use(Step("2 CorrelationId"));
app.MapGet("/orders/{id}", (int id) =>
{
    Console.WriteLine("3 Endpoint runs");
    return $"Order {id} shipped to Austin, TX";
});

await app.StartAsync();
var body = await app.GetTestClient().GetStringAsync("/orders/1042");
Console.WriteLine($"Response: {body}");
await app.StopAsync();

static Func<HttpContext, RequestDelegate, Task> Step(string name) => async (ctx, next) =>
{
    Console.WriteLine($"{name,-16}-> in");
    await next(ctx);
    Console.WriteLine($"{name,-16}<- out");
};

Output:

1 RequestTimer  -> in
2 CorrelationId -> in
3 Endpoint runs
2 CorrelationId <- out
1 RequestTimer  <- out
Response: Order 1042 shipped to Austin, TX

The output nests like parentheses: 1 in, 2 in, endpoint, 2 out, 1 out. That’s why the exception handler goes first, so it can catch anything thrown later.

Microsoft’s recommended order is: exception handler and HSTS, HTTPS redirection, static files, routing, CORS, authentication, authorization, then your custom middleware and endpoints. WebApplication adds UseRouting for you when you don’t call it.

Q15. How do you handle exceptions globally in ASP.NET Core? (Mid)

Short answer: Call app.UseExceptionHandler() early in the pipeline, register AddProblemDetails() so errors come back as RFC 7807 JSON, and optionally add an IExceptionHandler class for custom logic.

Inside the endpoint itself you still use try-catch in C# for errors you can actually recover from, like a retry. Don’t wrap every action in try-catch just to log; that’s what the handler is for.

Configuration and Options Pattern Interview Questions (Mid)

Q16. Where does ASP.NET Core read configuration from, and in what order? (Mid)

Short answer: WebApplication.CreateBuilder loads appsettings.json, then appsettings.{Environment}.json, then user secrets (in Development), then environment variables, then command-line arguments. Later sources win.

So Store__City=Denver as an environment variable overrides the JSON file. That’s how Azure App Service settings replace values without changing the deployed files.

Q17. What’s the difference between appsettings.json and secrets.json? (Junior)

Short answer: appsettings.json is committed with the code. secrets.json (user secrets) lives in your user profile, never in the repo, and only loads in Development.

In production, secrets belong in Azure Key Vault or environment variables, not in either file. Interviewers want to hear that you’ve never pushed a connection string to GitHub.

Q18. How does the options pattern work, and IOptions vs IOptionsSnapshot vs IOptionsMonitor? (Mid)

Short answer: You bind a configuration section to a plain class and inject IOptions<T>. IOptions reads once (singleton), IOptionsSnapshot re-reads per request (scoped), and IOptionsMonitor gets change notifications (singleton).

Here I bind a “Store” section from in-memory configuration, which is just a C# dictionary of keys like Store:City:

#:package Microsoft.Extensions.Options.ConfigurationExtensions@10.0.13
#:package Microsoft.Extensions.DependencyInjection@10.0.13
using System.Globalization;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Options;

CultureInfo.CurrentCulture = new CultureInfo("en-US");
// The same keys you'd put in appsettings.json under "Store"
var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
{
    ["Store:City"] = "Seattle",
    ["Store:SalesTaxRate"] = "0.1035",
    ["Store:FreeShippingOver"] = "75"
}).Build();

var services = new ServiceCollection();
services.AddOptions<StoreOptions>().Bind(config.GetSection("Store"));
using var sp = services.BuildServiceProvider();

StoreOptions store = sp.GetRequiredService<IOptions<StoreOptions>>().Value;
Console.WriteLine($"City: {store.City}");
Console.WriteLine($"Sales tax: {store.SalesTaxRate:P2}");
Console.WriteLine($"Free shipping over: {store.FreeShippingOver:C0}");

public class StoreOptions
{
    public string City { get; set; } = "";
    public decimal SalesTaxRate { get; set; }
    public decimal FreeShippingOver { get; set; }
}

Output:

City: Seattle
Sales tax: 10.35%
Free shipping over: $75

The binder turned the string “0.1035” into a decimal, shown as 10.35%. Add .ValidateDataAnnotations().ValidateOnStart() and a bad value fails at startup instead of on the first request.

Program.cs, Hosting and Kestrel Interview Questions (Mid)

Q19. What happened to Startup.cs, ConfigureServices and Configure? (Junior)

Short answer: Since .NET 6, the templates use minimal hosting: one Program.cs where builder.Services replaces ConfigureServices and the code after builder.Build() replaces Configure.

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddProblemDetails();        // was ConfigureServices

var app = builder.Build();
app.UseExceptionHandler();                    // was Configure
app.MapGet("/health", () => "OK");
app.Run();

Startup.cs still works if you call it from the generic host, so older apps don’t break. But if an interviewer asks about it, show that you know the Program.cs version.

Q20. What is the Generic Host, and what’s a Worker Service? (Mid)

Short answer: The Generic Host (IHost) wires up DI, configuration, logging and app lifetime for any .NET app. A Worker Service is a host with no web server that runs BackgroundService classes.

BackgroundService is an abstract class in C# where you override ExecuteAsync. It’s a good fit for queue processors or a nightly job that will send emails with attachments.

Q21. What is Kestrel, and do you still need IIS? (Mid)

Short answer: Kestrel is ASP.NET Core’s built-in, cross-platform web server. On Windows, IIS can host the app in-process through the ASP.NET Core Module; on Linux you usually put Nginx, YARP or a cloud load balancer in front.

Kestrel is fast enough to face the internet directly, but a reverse proxy still helps with TLS termination, multiple sites on one IP and request filtering.

Q22. How do you deploy ASP.NET Core to containers and Azure App Service? (Mid)

Short answer: For containers, dotnet publish /t:PublishContainer builds an image without a Dockerfile, and .NET 8+ images listen on port 8080 as a non-root user. For Azure App Service, publish from Visual Studio, the CLI or a GitHub Actions workflow.

Senior candidates should mention health checks (MapHealthChecks), deployment slots for zero-downtime swaps, and keeping secrets in Key Vault references.

Minimal APIs vs Controllers: Web API Interview Questions (Mid)

Q23. When would you use minimal APIs instead of controllers? (Mid)

Short answer: Minimal APIs are lighter and work with Native AOT, so they’re great for microservices and new APIs. Controllers still make sense for large apps that rely on filters, model binding conventions and an existing MVC codebase.

Both return JSON through System.Text.Json. If you’ve ever fought escaped quotes in output, my post on how to convert an object to JSON without escape characters explains the encoder settings.

var orders = app.MapGroup("/api/orders").RequireAuthorization();
orders.MapGet("/{id:int}", async (int id, OrderDbContext db) =>
    await db.Orders.FindAsync(id) is Order o ? Results.Ok(o) : Results.NotFound());

Q24. How do you document an API with OpenAPI (Swagger) in .NET 10? (Mid)

Short answer: Call builder.Services.AddOpenApi() and app.MapOpenApi(). Since .NET 9 the templates use Microsoft.AspNetCore.OpenApi instead of Swashbuckle, and in .NET 10 the generated document is OpenAPI 3.1 by default.

You can still add Swagger UI or Scalar for a browsable page. .NET 10 also added built-in minimal API validation with builder.Services.AddValidation().

Q25. What are Razor Pages, Blazor and SignalR used for? (Junior)

Short answer: Razor Pages is page-focused server rendering, Blazor builds interactive UI in C# (server or WebAssembly), and SignalR pushes real-time messages to browsers, like live order tracking.

SignalR’s hub methods feel a lot like events in C# that cross the network. For a quick server-to-browser stream, .NET 10 also has TypedResults.ServerSentEvents.

Authentication and Authorization Interview Questions (Mid to Senior)

Q26. Authentication vs authorization: how does JWT bearer authentication work? (Mid)

Authentication answers “who are you?” and builds the ClaimsPrincipal; authorization answers “what may you do?” with roles, claims or policies. That’s why UseAuthentication comes before UseAuthorization.

Short answer: The client sends Authorization: Bearer <token>. AddJwtBearer validates the signature, issuer, audience and expiry, then turns the claims into HttpContext.User.

Keep access tokens short-lived and never put secrets or personal data in the payload, because anyone can base64-decode it. Signing isn’t encryption.

Q27. How do you protect an API with Microsoft Entra ID? (Senior)

Short answer: Register the API in Microsoft Entra ID (formerly Azure AD), then use Microsoft.Identity.Web: AddAuthentication().AddMicrosoftIdentityWebApi(builder.Configuration) with an “AzureAd” config section, and require scopes or app roles per endpoint.

For apps with their own sign-in, ASP.NET Core Identity in .NET 10 now supports passkeys. If you’ve built a custom flow like an OTP in ASP.NET, be ready to explain why you’d move to a standard provider.

Q28. Which security measures do you add to every ASP.NET Core app? (Senior)

Short answer: HTTPS with HSTS, a strict CORS policy, antiforgery for cookie-based forms, rate limiting (AddRateLimiter), secrets in Key Vault, and authorization on by default with a fallback policy.

Entity Framework Core Interview Questions (Mid to Senior)

Q29. What is EF Core, and what does change tracking do? (Junior)

Short answer: EF Core is Microsoft’s ORM: you query with LINQ and save with SaveChangesAsync. Change tracking remembers loaded entities so it can generate UPDATE statements; AsNoTracking() skips that for read-only queries.

Queries come back as a List in C# or a single entity. Remember that AddDbContext registers the context as scoped, which ties back to the lifetime question above.

Q30. What is the N+1 problem, and how do you fix it? (Senior)

Short answer: N+1 is one query for a list plus one extra query per row, usually from lazy loading inside a loop. Fix it with Include, a Select projection to a DTO, or AsSplitQuery() for big graphs.

// 1 query instead of 1 + N
var report = await db.Customers
    .Where(c => c.State == "CA")
    .Select(c => new { c.Name, OrderCount = c.Orders.Count })
    .AsNoTracking()
    .ToListAsync();

Q31. How do you apply EF Core migrations in production? (Senior)

Short answer: Create them with dotnet ef migrations add, then in production apply a reviewed SQL script (dotnet ef migrations script --idempotent) or a migration bundle from your pipeline. Avoid calling Migrate() at app startup on multiple instances.

Async/Await and Logging Interview Questions (Mid)

Q32. How does async/await help an ASP.NET Core app? (Mid)

Short answer: While an await waits on I/O, the thread goes back to the pool to serve other requests. It doesn’t make one request faster, but it lets the server handle many more at once.

You can still make independent calls overlap. I called a fake 1-second tax API three times, first one after another, then with Task.WhenAll:

using System.Diagnostics;

var sw = Stopwatch.StartNew();
await GetRateAsync("Texas"); await GetRateAsync("Ohio"); await GetRateAsync("Utah");
Console.WriteLine($"One after another: {sw.Elapsed.TotalSeconds:F1} s");

sw.Restart();
decimal[] rates = await Task.WhenAll(GetRateAsync("Texas"), GetRateAsync("Ohio"), GetRateAsync("Utah"));
Console.WriteLine($"Task.WhenAll:      {sw.Elapsed.TotalSeconds:F1} s -> {string.Join(", ", rates)}");

// Pretend each call is a 1-second HTTP request to a sales tax API
static async Task<decimal> GetRateAsync(string state)
{
    await Task.Delay(1000);   // frees the thread while it waits, unlike Thread.Sleep
    return state switch { "Texas" => 6.25m, "Ohio" => 5.75m, _ => 6.10m };
}

Output:

One after another: 3.0 s
Task.WhenAll:      1.0 s -> 6.25, 5.75, 6.10

Sequential took 3.0 seconds and Task.WhenAll took 1.0. Never use .Result or .Wait() on a task in a request; it blocks a thread and can starve the pool.

Q33. What’s the difference between concurrency and parallelism, and what are async streams? (Senior)

Short answer: Concurrency is juggling several tasks that overlap in time (like the awaits above); parallelism is running work on several CPU cores at once (Parallel.ForEachAsync). Async streams (IAsyncEnumerable<T> with await foreach) return items as they arrive.

Q34. How does logging work with ILogger, and where does Serilog fit? (Mid)

Short answer: You inject ILogger<T> and write structured messages with named placeholders. Providers (console, Application Insights, Serilog) decide where they go, and the minimum level filters the noise.

#:package Microsoft.Extensions.Logging.Console@10.0.13
using Microsoft.Extensions.Logging;

using var factory = LoggerFactory.Create(b => b
    .AddSimpleConsole(o => o.SingleLine = true)
    .SetMinimumLevel(LogLevel.Information));
ILogger logger = factory.CreateLogger("Orders");

logger.LogDebug("Cart contents: {Items}", 3);    // below the minimum level, so it's skipped
logger.LogInformation("Order {OrderId} placed by {Customer}", 1042, "Jenna Moore");
logger.LogWarning("Inventory low for {Sku} in {City}", "SKU-778", "Denver");
logger.LogError(new TimeoutException("Payment gateway timed out"), "Payment failed for order {OrderId}", 1043);

Output:

info: Orders[0] Order 1042 placed by Jenna Moore
warn: Orders[0] Inventory low for SKU-778 in Denver
fail: Orders[0] Payment failed for order 1043 System.TimeoutException: Payment gateway timed out

The Debug line never printed because the minimum level was Information. Use {OrderId} placeholders, not string interpolation, so a sink like Serilog or Application Insights can store OrderId as a searchable field.

Serilog plugs in with builder.Host.UseSerilog(). Older apps often used log4net.

Performance and Caching Interview Questions (Senior)

Q35. IMemoryCache, IDistributedCache, HybridCache or output caching: which one? (Senior)

Short answer: Use IMemoryCache for one server, IDistributedCache (Redis) to share across servers, HybridCache for both layers plus stampede protection, and output caching to store whole HTTP responses.

HybridCache lives in the Microsoft.Extensions.Caching.Hybrid package and you register it with AddHybridCache(). Only one caller per key runs the factory, so a cold cache doesn’t hammer your database.

Q36. How would you speed up a slow ASP.NET Core API? (Senior)

Short answer: Measure first (Application Insights, dotnet-counters), then fix the biggest cost: usually database round trips, missing indexes or N+1 queries, then caching, response compression and async I/O.

Smaller wins come from avoiding allocations in hot paths, such as knowing the difference between string and StringBuilder in C#, and using IHttpClientFactory instead of creating HttpClient per call.

Testing Interview Questions: xUnit and WebApplicationFactory (Mid)

Q37. How do you unit test and integration test an ASP.NET Core app? (Mid)

Short answer: Unit test classes with xUnit (or NUnit/MSTest) and fakes for their interfaces. Integration test the whole pipeline with WebApplicationFactory<Program> from Microsoft.AspNetCore.Mvc.Testing, which runs the app on an in-memory TestServer.

public class OrdersApiTests(WebApplicationFactory<Program> factory)
    : IClassFixture<WebApplicationFactory<Program>>
{
    [Fact]
    public async Task Get_order_returns_200()
    {
        var client = factory.CreateClient();
        var response = await client.GetAsync("/orders/1042");
        response.EnsureSuccessStatusCode();
    }
}

With top-level statements, the test project needs to see Program, so many teams add public partial class Program { }; that’s a partial class in C#. The middleware demo above used the same TestServer underneath.

Behavioral .NET Interview Questions (All Levels)

US companies spend real time on these, often one full round. Answer with the STAR format: situation, task, action, result, and give numbers when you have them.

Q38. Tell me about a production bug you fixed. (All levels)

Short answer: Pick a real one with a clear cause, like a captive DbContext causing random errors under load. Explain how you found it (logs, traces), the fix, and what you changed so it can’t happen again.

Q39. How would you migrate a .NET Framework app to .NET 10? (Senior)

Short answer: Inventory dependencies, move class libraries first (to .NET Standard 2.0 or multi-target), then the web layer, one slice at a time behind a reverse proxy (the strangler pattern) so both apps run side by side.

Q40. How do you disagree with a teammate’s design? (All levels)

Short answer: Ask questions first, bring data like a quick benchmark or a spike, agree on the trade-off, and once the team decides, commit to it. Interviewers look for respect and ownership, not winning.

Which .NET Core Interview Questions to Study for Your Level?

My advice: run the six demos above yourself. Saying “I’ve seen ValidateScopes throw on this exact case” lands far better than reciting a definition.

For the C# side of the same interview loop, these pair well with this guide:

• C# interview questions for experienced developers
• C# interview questions for freshers
• OOP concepts in C# with examples
• Method overriding in C#

Frequently Asked Questions

Bijay Kumar

Bijay Kumar is a renowned software engineer, accomplished author, and distinguished Microsoft Most Valuable Professional (MVP) specializing in SharePoint. With a rich professional background spanning over 15 years, Bijay has established himself as an authority in the field of information technology. He possesses unparalleled expertise in multiple programming languages and technologies such as ASP.NET, ASP.NET MVC, C#.NET, and SharePoint, which has enabled him to develop innovative and cutting-edge solutions for clients across the globe. Read more…

aspdotnethelp.com