Developer guides and tutorials

The appsettings Mistake That Can Expose a Staging Connection String

A staging connection string with real credentials ended up shipped in a publish artifact. Here is exactly how dotnet publish copies appsettings files, and how to stop it.

A Cron Expression That Ran at Midnight UTC Instead of Midnight IST

A daily job meant to run at midnight IST actually ran at midnight UTC — 5.5 hours later in India time. Here is the exact .NET/Hangfire timezone mechanics and the fix.

Why a Perfectly Valid JSON Body Can Still Return 415 Unsupported Media Type

The JSON body was completely valid. ASP.NET Core still rejected it with 415 Unsupported Media Type — before the controller action ever ran. Here is exactly why, plus a separate System.Text.Json gotcha that looks similar but isn't.

Why Our Scheduled Jobs Ran at the Wrong Time After Deploying to Azure

Azure App Service runs in UTC. A cron expression written for 9 AM IST ran at 2:30 PM. Here is how to write timezone-correct cron schedules for Hangfire, Quartz.NET, and Azure Functions.

HTTP Status Codes: The Complete Developer Reference

Every IANA-registered HTTP status code, what it means, and how to return it correctly from ASP.NET Core with TypedResults, HttpStatusCode, and IActionResult.

Debugging a JWT That Validated Locally But Failed in Production

A JWT decoded fine and validated in Development but every request failed with SecurityTokenInvalidIssuerException in Production. Here is the exact ASP.NET Core JWT bearer mechanics behind it.

The EF Core Migration That Would Have Dropped a Production Column

A one-line C# property rename generated an EF Core migration that would have silently deleted a production column's data. Here is exactly why, and the fix.

The Regex That Worked in Production But Caused 100% CPU Usage Under Load

A template validator regex caused 90-second CPU spikes under specific user input. The cause was catastrophic backtracking from nested quantifiers, and the fix involved Regex timeouts and RegexOptions.NonBacktracking.

We Used MD5 for Our File Integrity Checks. Here's Why We Switched to SHA-256.

A security audit flagged MD5 checksums in our .NET file processing service. Here is exactly when MD5 is dangerous, when it is still acceptable, and the C# migration to SHA-256.

SQL Formatter Saved Me From Deploying a Query That Would Have Locked Our Entire Orders Table

Formatting a minified EF Core-generated SQL query before production deployment revealed a missing WHERE clause that would have updated all 2.7 million rows in our orders table.

The Base64 Encoding Bug That Corrupted Our Azure Blob Storage Filenames

Standard Base64 uses + and / which are not URL-safe. When encoded filenames were used in blob storage URLs, files silently became unreachable. Here is the C# fix using Base64URL.

Why Our JWT Tokens Were Rejected by a Third-Party API — and What I Learned About Clock Skew

A real debugging story: service-to-service JWT 401 errors caused by clock drift between Azure VMs. Includes the C# fix for nbf backdating and ClockSkew configuration in ASP.NET Core.

The appsettings.json Bug That Takes Down .NET Apps in Production (And How to Catch It Before Deploy)

A JWT audience key existed in appsettings.Development.json but never made it into Production. The app deployed cleanly and broke every login on the first real request. Here is the bug, the fix, and the diff tool that catches it before deploy.

From CREATE TABLE to EF Core Entity: Scaffolding Done Right

dotnet ef dbcontext scaffold vs hand-writing entities, data annotations vs fluent configuration, and how nullable reference types actually map from your schema.

Connection Strings in .NET 8: Every Provider, Every Gotcha

SQL Server, Azure SQL, PostgreSQL, MySQL, and Cosmos DB connection string formats compared, the Encrypt/TrustServerCertificate defaults, and where secrets actually belong.

The Hidden Junk in Your .csproj: What You Can Delete and What You Can't

SDK-style defaults, properties that are safe to remove, duplicate PackageReferences, and legacy elements that look dead in a .csproj but might not be.

How LINQ Translates to SQL — and Where EF Core Will Surprise You

Expression trees vs SQL translation, N+1 from lazy loading, client evaluation traps, and why Contains() becomes LIKE or IN depending on what you call it on.

Hash Functions Explained: MD5, SHA-256, bcrypt and When to Use Each

Learn how cryptographic hash functions work, the difference between MD5, SHA-1, SHA-256, and bcrypt, and which one to choose for checksums, passwords, and data integrity.

YAML Explained: Syntax, Use Cases and How It Differs from JSON

Learn YAML syntax from scratch — scalars, sequences, mappings, anchors, and multi-document files. Understand when to use YAML over JSON and how to convert between them.

URL Encoding Explained: What %20 Means and How Percent-Encoding Works

Understand percent-encoding — why special characters become %20 or %2F, the difference between encodeURI and encodeURIComponent, and how to encode query strings correctly.

Unix File Permissions Explained: chmod, Octal Notation and Symbolic Mode

Understand Linux/Unix permission bits, how to read and set them with chmod, and the difference between octal and symbolic notation.

Generating Test Data for 10,000 Entity Framework Records Without Losing Your Mind

Performance bugs hide in unit tests with 50 records. Here is how to use the Bogus library to generate realistic EF Core seed data at production scale to find real problems before users do.

The URL Encoding Mistake That Broke Our OAuth 2.0 Redirect URIs

HttpUtility.UrlEncode and Uri.EscapeDataString produce different output. Our OAuth redirect_uri failed because one uses lowercase hex and the other uppercase. Here is which one OAuth servers expect.

What is JSON? A Complete Guide to Formatting and Validation

Learn what JSON is, how to format it correctly, validate it, spot common mistakes, and why it became the universal data exchange format.

How We Reduced Our API Response Payload by 40% by Auditing Our JSON Output

An EF Core product listing endpoint was returning 340KB instead of 9KB. Formatting the JSON response revealed navigation properties, circular references, and shadow properties being serialized unnecessarily.

Regular Expressions (Regex) Tutorial for Developers

A hands-on regex guide covering character classes, quantifiers, groups, lookaheads, and the most useful real-world patterns.

Debugging a DateTime Comparison Bug That Only Failed in Production

We compared DateTime.Now (local server time) with a Unix timestamp from a payment API. The comparison worked in development but failed after migrating to Azure. The fix: DateTimeOffset everywhere.

Base64 Encoding and Decoding: What It Is and When to Use It

Learn what Base64 encoding is, how it works byte-by-byte, its common uses in web development, and when not to use it.

UUID vs GUID: What They Are and When to Use Them

Understand the difference between UUID and GUID, all UUID versions (v1–v7), and best practices for unique identifier generation.

How QR Codes Work: Types, Error Correction, and Generation Guide

Understand QR code structure, data capacity, error correction levels, and how to generate the right QR code for any use case.

JWT Tokens Explained: Header, Payload, Signature and Security

A practical guide to JSON Web Tokens — how they are structured, signed, decoded, and when to use them over session cookies.

Cron Expression Guide: Write Schedules with Confidence

Master cron syntax with practical examples — from simple daily jobs to complex multi-field schedules. Includes a quick-reference table.