.NET Backend Development Standards

Core Requirements

• •MUST target .NET 8 LTS or .NET 10 for new projects
• •MUST enable nullable reference types and implicit usings
• •MUST run dotnet format or CSharpier after code changes
• •SHOULD upgrade .NET 6 or earlier to at least .NET 8

Naming Conventions

• •Names MUST be descriptive and express intent clearly
• •SHOULD NOT use abbreviations or Hungarian notation

Modern C# Features

Code Structure

• •Methods MUST focus on single responsibility
• •Methods SHOULD NOT exceed 5 parameters - use objects/builders
• •MUST remove duplicated code blocks
• •MUST replace magic numbers with named constants
• •SHOULD simplify nested logic - avoid deep if trees
• •SHOULD favor immutable objects (readonly where possible)
• •SHOULD use var when type is clear from right-hand side

Error Handling and Resources

• •MUST use using/await using for disposable resources
• •MUST handle exceptions meaningfully - no empty catch blocks
• •SHOULD catch specific exception types, not base Exception
• •SHOULD create custom exceptions for domain-specific errors
• •SHOULD use ArgumentNullException.ThrowIfNull() for null checks

Dependency Injection

• •MUST use constructor injection for all dependencies
• •MUST declare dependency fields as private readonly
• •MUST NOT use IServiceProvider directly in business logic
• •SHOULD use IOptions<T> for type-safe configuration

public class UserService(
    IUserRepository repository,
    IOptions<UserSettings> settings,
    ILogger<UserService> logger)
{
    public async Task<User?> GetUserAsync(int id)
    {
        var user = await repository.GetByIdAsync(id);
        if (user is null)
            logger.LogWarning("User {UserId} not found", id);
        return user;
    }
}

Data Access (Entity Framework Core or Dapper)

• •MUST use EF Core or Dapper for database operations
• •MUST use parameterized queries to prevent SQL injection
• •MUST use appropriate loading strategies to avoid N+1 queries (when using EF Core):
  • •.Include() for eager loading
  • •Split queries for complex includes
  • •.Select() projections when full entities aren't needed
• •SHOULD use AsNoTracking() for read-only queries (EF Core)
• •SHOULD NOT use raw SQL when LINQ methods suffice
• •MUST NOT expose EF Core entities directly in API responses

Logging

• •MUST use ILogger<T> for all logging
• •MUST use structured logging with message templates
• •MUST NOT use Console.WriteLine() for logging

_logger.LogInformation("Processing order {OrderId} for user {UserId}", orderId, userId);
_logger.LogError(ex, "Failed to process order {OrderId}", orderId);

Validation

• •MUST validate all external input at application boundaries
• •MUST use FluentValidation or Data Annotations
• •MUST sanitize user inputs before use

public class CreateUserValidator : AbstractValidator<CreateUserRequest>
{
    public CreateUserValidator()
    {
        RuleFor(x => x.Email).NotEmpty().EmailAddress();
        RuleFor(x => x.Name).NotEmpty().MaximumLength(100);
    }
}

API Development

• •MUST use RESTful conventions
• •MUST version API endpoints (e.g., /api/v1/users)
• •MUST use [ApiController] attribute for REST controllers
• •MUST implement proper error handling with ProblemDetails (RFC 7807)
• •MUST use DTOs for request/response objects
• •MUST document APIs using Swagger/OpenAPI

HTTP Status Codes

[ApiController]
[Route("api/[controller]")]
public class UsersController(IUserService userService) : ControllerBase
{
    [HttpGet("{id}")]
    [ProducesResponseType<UserDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
    public async Task<ActionResult<UserDto>> GetUser(int id)
    {
        var user = await userService.GetUserAsync(id);
        return user is null ? NotFound() : Ok(user);
    }
}

Testing

• •MUST write unit tests for all public methods
• •MUST follow Arrange-Act-Assert (AAA) pattern
• •MUST mock external dependencies using Moq, NSubstitute, or FakeItEasy
• •MUST test error scenarios and edge cases
• •SHOULD use xUnit as testing framework
• •SHOULD use WebApplicationFactory<T> for integration tests

public class UserServiceTests
{
    private readonly Mock<IUserRepository> _mockRepo = new();
    private readonly UserService _service;

    public UserServiceTests() =>
        _service = new UserService(_mockRepo.Object, Options.Create(new UserSettings()), Mock.Of<ILogger<UserService>>());

    [Fact]
    public async Task GetUserAsync_WhenExists_ReturnsUser()
    {
        // Arrange
        var expected = new User { Id = 1, Name = "Test" };
        _mockRepo.Setup(r => r.GetByIdAsync(1)).ReturnsAsync(expected);

        // Act
        var result = await _service.GetUserAsync(1);

        // Assert
        Assert.Equal(expected, result);
    }
}

Security

• •MUST use parameterized queries (prevent SQL injection)
• •MUST implement proper authentication/authorization
• •MUST use HTTPS for all production communications
• •MUST store secrets using User Secrets or Azure Key Vault
• •MUST NOT log passwords or tokens
• •SHOULD implement proper CORS configuration

Performance

• •SHOULD use caching (IMemoryCache or distributed cache) when appropriate
• •SHOULD use async processing for non-blocking operations
• •SHOULD enable response compression for APIs when appropriate
• •MUST implement pagination for large datasets
• •SHOULD use Span<T> and Memory<T> for buffer operations
• •SHOULD use StringBuilder for string concatenation in loops

Anti-Patterns to Avoid

Configuration

• •MUST use appsettings.json for externalized configuration (or Azure Key Vault / App Configuration for enterprise settings)
• •SHOULD use appsettings.{Environment}.json for environment-specific settings when not using Key Vault / App Configuration
• •SHOULD use Directory.Build.props for centralized package versions
• •MUST keep dependencies up to date and audit for vulnerabilities

Note: For enterprise applications, prefer Azure Key Vault and App Configuration over appsettings.{Environment}.json files for environment-specific and sensitive configuration.

All .NET projects MUST adhere to these standards for consistency, maintainability, and security.