mir-backend-dotnet-aspnetcore
SolidMake It Right (ASP.NET Core module). ASP.NET Core 10 + Minimal APIs + EF Core 10 footguns. Covers: DI lifetime errors (AddDbContext Scoped vs singleton capture, IHttpContextAccessor caveats), middleware pipeline ORDER (UseRouting -> UseAuthentication -> UseAuthorization -> UseAntiforgery -> endpoints; wrong order silently disables auth), model binding overposting onto EF entities and why [Bind] does NOT work on JSON bodies, response DTO discipline against field leakage, EF Core N+1 and the EF Core 10 parameterized-collection translation change, ExecuteUpdate/ExecuteDelete bypassing the change tracker, object-level authorization (IDOR via a valid token, no resource check), .NET 10 AddValidation, the non-short-circuiting antiforgery middleware, and CORS credentials misconfiguration. Chains: mir-backend -> mir-backend-dotnet (CLR runtime) -> this, which adds only ASP.NET Core / EF Core library mechanics. TRIGGER only when the .NET backend stack uses ASP.NET Core or Minimal APIs — building, reviewing, or debuggin
Install
Quality Score: 81/100
Skill Content
Details
- Author
- anantbhandarkar
- Repository
- anantbhandarkar/make-it-right
- Created
- 3 months ago
- Last Updated
- 1 weeks ago
- Language
- Python
- License
- Apache-2.0
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
mir-backend-dotnet
Make It Right (.NET runtime tier). CLR/CoreCLR reliability footguns shared across every .NET backend framework. Covers: runtime version currency (.NET 10 is the current LTS; 8 and 9 leave support 10 Nov 2026), sync-over-async deadlock and thread-pool starvation (.Result/.Wait()/.GetAwaiter().GetResult()), ConfigureAwait(false) in library code, ValueTask misuse, IDisposable/IAsyncDisposable discipline and HttpClient socket/DNS exhaustion, DbContext thread-safety and lifetime, DI captive dependency (Scoped or Transient injected into Singleton) with ValidateScopes only running in Development, CancellationToken propagation, BackgroundService host-kill semantics, the DATAS server-GC default, trimming/Native AOT reflection breakage, and CLR-level security (BinaryFormatter removal, ProcessStartInfo.ArgumentList, Path.Combine traversal, SSRF via HttpClient redirects, NuGet lockfile and package source mapping). Chains: mir-backend -> this -> framework module. TRIGGER when the backend runtime is .NET / CLR — any C# or
mir-backend-node-nestjs
Make It Right (NestJS module). NestJS 11 + TypeScript specific reliability augmentation. Use alongside mir-backend and mir-backend-node when the target stack is NestJS — it carries the mechanical footguns that the framework-agnostic tiers deliberately omit: singleton DI scope bleeding request state across users, the full execution-order pipeline (middleware → guards → interceptors → pipes → handler → interceptors → exception filters) and why middleware is not a security boundary on the Fastify adapter, ValidationPipe with whitelist and forbidNonWhitelisted to stop mass assignment, ClassSerializerInterceptor as the outbound allow-list, the Express 5 route-syntax break that NestJS 11 inherits, the TypeScript 7 compiler-API break that stops nest build, and offloading durable work to BullMQ rather than running it in a request. TRIGGER only when the Node backend stack is NestJS — building, reviewing, or debugging a NestJS controller, provider, module, guard, pipe, interceptor, or exception filter, on either the Ex
mir-backend-go
Make It Right (Go runtime tier). Go 1.25/1.26 runtime reliability footguns shared across every Go backend framework (Gin, Fiber, Echo, chi, stdlib net/http) — distinct from the generic backend gates and from any one framework's mechanics. Covers: goroutine leaks (the #1 Go reliability bug) and the runtime goroutineleak profile, context propagation and cancellation, data races and `go test -race`, channel ownership rules, goroutine-level panic recovery, the nil-interface/nil-pointer trap, defer-in-loop resource buildup, slice aliasing, error wrapping with errors.Is/As/AsType, sync.WaitGroup.Go, the Go 1.22 per-iteration loop-variable change and its go.mod gating, deterministic concurrency tests with testing/synctest, container-aware GOMAXPROCS, log/slog structured logging, and Go-level security mechanics (http.Server timeouts, net/http CrossOriginProtection, os.Root path containment, SSRF dialer control, module checksum verification, govulncheck). TRIGGER when the backend runtime is Go — sits between mir-backe