APIs & Security
REST, GraphQL, gRPC compared — plus authentication methods, API design, and secure inter-service communication.
Courses
Master how microservices talk to each other — synchronous REST and gRPC, async messaging, event-driven patterns, resilience, and distributed consistency.
Articles
Building a single monolithic GraphQL server across dozens of engineering teams creates code ownership conflicts and deployment bottlenecks. …
A travel checkout may call a public weather API, your own booking API, and a partner airline API. All three could use REST, but they should …
Shipping faster in .NET is less about memorizing NuGet packages and more about knowing which job needs a tool: identity, data access, tests,…
HTTPS and a valid JWT only prove the front door locked. Many real API incidents happen after authentication succeeds: a user changes /orders…
Many .NET teams stop at "add [Authorize] and check roles." That covers two of seven authorization models ASP.NET Core ships with — and leave…
A well-designed REST API is a contract. Clients depend on its URLs, error shape, and pagination for years; an accidental breaking change can…
Live UIs need the server to push changes — stock ticks, chat lines, build progress, presence. Classic HTTP is pull-only: the client asks, th…
JSON Web Tokens are a common access-token format, but OAuth 2.0 does not require them: providers may issue opaque bearer tokens that an API …
You log out and the admin panel still accepts the old token. Or you build "Sign in with Google" and accidentally treat an access token as pr…
One buggy client can retry a failing endpoint in a tight loop and starve everyone else. Rate limiting protects shared capacity and keeps abu…
A partner script scrapes your API with a leaked key. A mobile build ships a password in every header. A "Sign in with GitHub" button works u…
A checkout call may hit REST at the gateway, a GraphQL BFF for the mobile screen, gRPC between order and inventory, and a webhook when the p…
Your mobile team wants one round trip for a screen. Your partner wants a stable URL they can cache. Your services need typed calls inside th…
A developer opens the console, sees a red "blocked by CORS policy" error on a fetch call, and assumes the request never reached the server. …
A mobile app adds "Sign in with Provider," gets back a token, and calls it a login. OAuth 2.0 was never built to answer "who is this user" —…
Want a guided sequence? Follow a learning path that includes this topic.
View Learning Paths