Minimal hosting and Program.cs

Mental model

Understand how WebApplicationBuilder composes the generic host, registers services, and builds an ordered middleware pipeline in a single top-level file. Distinguish build-time service registration from runtime request handling, and keep Program.cs a thin composition root rather than a place for business logic.

Production practice

Compose a minimal hosting file that registers services before building the app and maps endpoints after. Evaluate ownership, runtime validation, failure states, server trust, and measurable performance before choosing an abstraction.

Common failure modes

Watch for injecting scoped services into singletons, unvalidated boundaries, silent N+1 queries, permissive CORS or missing rate limits, and client-only checks mistaken for real security. Keep boundaries explicit and test the observable contract with real HTTP calls.

Takeaways

• Choose lifetimes and abstractions from ownership and request scope.
• Validate untrusted input at the trusted server boundary.
• Authorize beside the protected operation, not just in middleware.
• Measure before optimizing, and plan rollback before deploying.