Skip to content

Glossary

A senior .NET full-stack vocabulary. Topic files link into here on first use of a term. Entries are kept short — the full treatment lives in the topic.

A

  • ABAC (Attribute-Based Access Control) — authorization model where decisions are derived from attributes (user, resource, environment) rather than fixed roles. Compare with RBAC.
  • ACA (Azure Container Apps) — Azure's serverless container platform built on Kubernetes + KEDA + Dapr. Scale-to-zero, revisions, ingress; the lighter alternative to AKS for stateless workloads.
  • ACI (Azure Container Instances) — bare-bones single-container Azure runtime. No orchestration; useful for batch jobs or simple sidecars where AKS/ACA is overkill.
  • ACID (Atomicity, Consistency, Isolation, Durability) — the classic transactional guarantees offered by relational databases. Senior shorthand: "this needs ACID" = "must be in a single DB transaction." Compare with BASE.
  • ADR (Architecture Decision Record) — a short markdown document capturing a significant architectural decision, its context, and trade-offs. Lives in-repo (docs/adr/) so reasoning is preserved alongside the code.
  • AFD (Azure Front Door) — Microsoft's global L7 reverse proxy + CDN + WAF. Used for multi-region routing, TLS termination, and edge caching in front of AKS / ACA / App Service.
  • ALC (AssemblyLoadContext) — .NET's pluggable assembly-loading sandbox. Each ALC has its own type identity; used by plugins, hot-reload, and isolation scenarios. Distinct from AppDomains (which were removed in .NET Core).
  • AOT (Ahead-Of-Time compilation) — compiling IL to native code at build time instead of at runtime via JIT. NativeAOT in .NET produces a fully native binary with no JIT, no reflection-emit, and aggressive trimming. → NativeAOT & Trimming
  • A2A protocol — Agent-to-Agent communication protocol. Used by Microsoft Agent Framework for multi-agent orchestration.
  • ActivitySource — the modern .NET API (System.Diagnostics) for emitting distributed-tracing spans. Backs OpenTelemetry.
  • Agent Framework — Microsoft's multi-agent orchestration library. v1.0 GA April 2026. Replaces AutoGen and supersedes Semantic Kernel agents for new work.
  • Aspire — .NET cloud-native orchestration tool (project + dashboard + integrations). Stitches services, databases, message brokers into a single dev-time graph.
  • Async state machine — the compiler-generated struct that drives an async method. Implements IAsyncStateMachine, captures locals, drives MoveNext on each continuation.

B

  • BASE (Basically Available, Soft state, Eventual consistency) — the trade-off philosophy of distributed/NoSQL systems: availability over strict consistency. Compare with ACID.
  • BCL (Base Class Library) — the core .NET libraries shipped with the runtime (System.*). Distinguish from "FCL" (Framework Class Library, .NET Framework era).
  • BFF (Backend-For-Frontend) — a server-side facade in front of an SPA that holds tokens server-side and exposes a curated API to the browser.
  • BREACH — TLS-with-compression attack: an attacker who can inject reflected content into a compressed HTTPS response infers secrets via length oracles. Affects response compression on HTTPS.
  • BackgroundService — base class in Microsoft.Extensions.Hosting for long-running background work. Implements IHostedService with ExecuteAsync.

C

  • CAP theorem — distributed-systems result: under network partition (P) you must choose Consistency or Availability. Practical takeaway: tunable consistency (Cosmos DB) > theoretical purity.
  • CDN (Content Delivery Network) — geographically distributed cache for static (and increasingly dynamic) content. Examples: Azure Front Door, CloudFront, Cloudflare.
  • CIDR (Classless Inter-Domain Routing) — IP-range notation like 10.0.0.0/8. Used in KnownNetworks, NSG rules, VNet design.
  • CLR (Common Language Runtime) — .NET's execution engine. Modern incarnation: CoreCLR. Handles JIT, GC, type loading.
  • CORS (Cross-Origin Resource Sharing) — browser security model that controls which origins can call an API. Configure via UseCors + policies.
  • CPM (Central Package Management) — Directory.Packages.props mechanism that pins NuGet versions in one place across a solution.
  • CRUD (Create, Read, Update, Delete) — the four basic persistence operations. Often used as shorthand for "thin pass-through API over a table."
  • CSP (Content Security Policy) — HTTP header that restricts which sources the browser may load scripts/styles/etc. from. Defense-in-depth against XSS.
  • CSRF (Cross-Site Request Forgery) — attack where a user's browser is tricked into making authenticated requests they didn't intend. Mitigated by anti-forgery tokens, SameSite cookies.
  • Cancellation token — CancellationToken is the cooperative cancellation signal threaded through async methods. Honored via ThrowIfCancellationRequested or polling.
  • Channel\<T> — bounded or unbounded async producer-consumer queue in System.Threading.Channels. Preferred over hand-rolled queues.
  • ConfigureAwait(false) — suppresses sync-context capture on a continuation. Library code generally uses it; ASP.NET Core app code generally doesn't need it because there's no captured sync context.
  • CQRS (Command-Query Responsibility Segregation) — separating write-side commands from read-side queries, often with different models.

D

  • DAU / MAU (Daily / Monthly Active Users) — capacity-planning anchor metric. Drives back-of-envelope QPS estimates: DAU × actions/day ÷ 86,400 sec ≈ avg QPS.
  • DATAS (Dynamically Adapting To Application Sizes) — .NET 9 GC mode (now default for server GC) that adapts heap sizing dynamically.
  • DDD (Domain-Driven Design) — modeling approach centered on aggregates, value objects, bounded contexts, and ubiquitous language.
  • DI (Dependency Injection) — pattern + .NET's built-in Microsoft.Extensions.DependencyInjection container. Lifetimes: Singleton / Scoped / Transient.
  • DOM (Document Object Model) — the in-memory tree representation of an HTML/XML document a browser exposes to JavaScript. Manipulating the DOM directly is the foot-gun SPAs (React/Angular) replace with virtual-DOM diffing.
  • DTO (Data Transfer Object) — flat, serialization-friendly type for moving data across boundaries (HTTP, queue, DB). Distinct from domain entities.

E

  • EF Core (Entity Framework Core) — Microsoft's primary O/RM. Tracks changes to entities and translates LINQ to SQL.
  • ETag — HTTP header carrying a version identifier for a resource. Used with If-Match for optimistic concurrency.

F

  • Foundry (Azure AI Foundry) — Microsoft's hosted AI platform. SDKs at v2.0 (April 2026). Includes managed agent service, model catalog, evaluations.

G

  • GC (Garbage Collector) — .NET's automatic memory manager. Generational (gen0/gen1/gen2 + LOH + POH).
  • GPT (Generative Pre-trained Transformer) — the transformer architecture family popularized by OpenAI. Loosely synonymous with "modern large language model" in casual usage.
  • gRPC — high-performance RPC framework over HTTP/2 using Protobuf.
  • GRS (Geo-Redundant Storage) — Azure Storage replication tier that copies data across paired regions. Variants: GRS, GZRS, RA-GRS (read-access).

H

  • HNSW (Hierarchical Navigable Small World) — graph-based approximate nearest-neighbor index used by most modern vector databases (Qdrant, pgvector, Azure AI Search). Trades exactness for sub-linear search.
  • HTTP/3 — HTTP over QUIC (UDP-based transport). Supported in Kestrel; reduces head-of-line blocking.
  • HybridCache — .NET 9 unified L1+L2 cache abstraction (in-memory + distributed) with stampede protection.

I

  • IaC (Infrastructure as Code) — declaring infrastructure via versioned text (Bicep, Terraform, ARM, Pulumi) instead of clicking in a portal.
  • IChatClient — canonical .NET LLM client interface in Microsoft.Extensions.AI. Every provider implements it.
  • IdP (Identity Provider) — service that authenticates users and issues tokens. Examples: Entra ID, Auth0, Okta, Duende IdentityServer.
  • IExceptionHandler — Microsoft.AspNetCore.Diagnostics interface for converting exceptions into HTTP responses. Replaces ad-hoc middleware error handlers.
  • IHostedService — interface for long-running background work hosted by the generic host.
  • IOptionsSnapshot vs IOptionsMonitor — IOptionsSnapshot<T> is scoped (recomputed per request); IOptionsMonitor<T> is singleton with change notifications.

J

  • JIT (Just-In-Time compilation) — compiling IL to native at runtime. .NET uses tiered JIT with dynamic PGO (profile-guided optimization).
  • JWT (JSON Web Token) — signed token format used for stateless authentication. Validation pitfalls: alg=none, audience, issuer, clock skew, key confusion.

K

  • K8s (Kubernetes) — container orchestrator. Provides deployments, services, scaling, rolling updates, secrets, config maps. AKS is Azure's managed flavor.
  • Kestrel — ASP.NET Core's cross-platform web server. Hosts on top of SocketsHttpHandler. Supports HTTP/1.1, HTTP/2, HTTP/3.
  • KQL (Kusto Query Language) — Azure's query language for Log Analytics, App Insights, and Azure Data Explorer. Pipe-style (| where, | summarize).

L

  • LLM (Large Language Model) — transformer-based language model with billions of parameters. In this guide: GPT-5, Claude, Gemini, Llama, Phi families.
  • LOH (Large Object Heap) — heap region for objects ≥85 KB. Not compacted by default; allocations fall straight into gen2.
  • LRU (Least Recently Used) — cache eviction policy: drop the entry untouched longest. Common live-coding pattern.

M

  • MCP (Model Context Protocol) — Anthropic's open protocol for LLM tool/resource discovery. Official C# SDK v1.0 March 2026.
  • mTLS (Mutual TLS) — both client and server present X.509 certificates. Used for service-to-service trust in zero-trust networks.
  • MediatR — popular .NET in-process mediator library; commonly paired with CQRS.
  • Microsoft.Extensions.AI — Microsoft's unified AI abstractions (IChatClient, IEmbeddingGenerator, middleware pipeline).
  • Minimal APIs — lightweight ASP.NET Core API definition style introduced in .NET 6, reaching MVC parity in .NET 8/9.

N

  • NativeAOT — see AOT.

O

  • OIDC (OpenID Connect) — identity layer on top of OAuth 2.0. Standard for federated login.
  • ONNX (Open Neural Network Exchange) — vendor-neutral model format. ONNX Runtime executes models cross-platform; common in edge/local-inference scenarios where you don't want a cloud LLM.
  • OpenTelemetry (OTel) — vendor-neutral observability standard. .NET integrates via System.Diagnostics.ActivitySource and Microsoft.Extensions.Diagnostics.
  • ORM (Object-Relational Mapper) — library that maps between objects and relational tables. EF Core is the canonical .NET ORM.
  • OTLP (OpenTelemetry Protocol) — the wire protocol OTel uses to ship traces/metrics/logs to a collector. gRPC and HTTP/protobuf bindings.
  • Outbox pattern — write a domain event to the same DB transaction as the state change, then a relay forwards to the broker. Solves dual-write problem.

P

  • p50 / p95 / p99 (percentile latency) — the latency at which N% of requests complete or faster. p99 is the senior's preferred SLO target — average latency hides tail issues.
  • PGO (Profile-Guided Optimization) — JIT optimization technique using runtime profile data. Dynamic PGO became default in .NET 6+.
  • POH (Pinned Object Heap) — heap region added in .NET 5 for objects pinned for interop. Avoids fragmenting other heap regions.
  • Polly — resilience library. v8 introduced ResiliencePipeline replacing the older policy model.
  • ProblemDetails — RFC 7807 / 9457 standardized HTTP error response format. ASP.NET Core has built-in support via AddProblemDetails.

Q

  • QPS / RPS / TPS (Queries / Requests / Transactions Per Second) — throughput units. Capacity-planning shorthand. "Peak QPS" matters more than average for sizing.
  • QUIC — UDP-based transport protocol underpinning HTTP/3.

R

  • RAG (Retrieval-Augmented Generation) — pattern of grounding LLM prompts with retrieved context (typically from a vector store).
  • RBAC (Role-Based Access Control) — authorization model using fixed roles (Admin, Reader). Compare with ABAC (attribute-based).
  • REST (Representational State Transfer) — HTTP-based architectural style: resources via URIs, stateless requests, standard verbs (GET/POST/PUT/DELETE).
  • ResiliencePipeline — Polly v8's composable resilience primitive.
  • RPO / RTO (Recovery Point / Time Objective) — disaster-recovery targets. RPO = max data loss in time (e.g., "≤5 min stale"). RTO = max downtime to restore service.
  • RU (Request Unit) — Cosmos DB's normalized billing/throughput unit. 1 KB point-read ≈ 1 RU; complex queries cost more. Sizing model is "provisioned RU/s".

S

  • Saga — long-running distributed transaction pattern. Two flavors: orchestration (central coordinator) and choreography (event-driven).
  • SAS (Shared Access Signature) — Azure Storage delegated-access token. URI with embedded permissions + expiry; preferred over storage account keys for client-facing access.
  • Semantic Kernel — Microsoft's earlier AI orchestration framework. Still relevant but superseded by Agent Framework for new agent work.
  • SignalR — real-time bidirectional communication library; abstracts WebSockets/SSE/long-polling with automatic transport negotiation.
  • SLA / SLO / SLI (Service Level Agreement / Objective / Indicator) — SLI = the metric (e.g., p99 latency). SLO = the target (e.g., "<200 ms"). SLA = the contract (often with penalties). Senior framing: "alert on SLO burn rate, not raw error counts."
  • SocketsHttpHandler — the modern HTTP handler underneath HttpClient since .NET Core 2.1.
  • Source generator — Roslyn extensibility producing C# code at compile time. Used by [LoggerMessage], [GeneratedRegex], JsonSerializerContext.
  • SSE (Server-Sent Events) — unidirectional server→client push over a long-lived text/event-stream HTTP response. Lighter than WebSocket for one-way streams.
  • STJ (System.Text.Json) — .NET's built-in JSON serializer (in-box since .NET Core 3.0). Faster + AOT-friendlier than Newtonsoft.Json; the default for ASP.NET Core.

T

  • Testcontainers — library for spinning up real Docker containers for integration tests (Postgres, Redis, Kafka, etc).
  • TimeProvider — abstraction added in .NET 8 for test-time control over DateTimeOffset.UtcNow and timers.
  • TLS (Transport Layer Security) — encryption + authentication layer underneath HTTPS. Successor to SSL. Compare with mTLS.
  • TTL (Time To Live) — expiry timer on cached / stored data. Cache TTL governs staleness; DNS TTL governs propagation; Cosmos DB TTL auto-deletes documents.

U

  • UoW (Unit of Work) — pattern that groups operations into a single transaction. EF Core's DbContext IS a UoW.

V

  • ValueTask\<T> — allocation-free alternative to Task<T> for hot paths where the result is often available synchronously.
  • Vertical Slice Architecture — organizing code by feature (slice) rather than by technical layer.

W

  • WAF (Web Application Firewall) — L7 filter that inspects HTTP traffic for common attacks (OWASP Top 10 patterns). Azure offers WAF on Front Door and Application Gateway.
  • WebApplicationFactory — ASP.NET Core integration test helper that bootstraps the app in-memory with overridable services.
  • WebSocket — bidirectional binary/text protocol over an upgraded HTTP connection. Lower-level than SignalR; preferred when you need binary or full-duplex.

X

  • XSS (Cross-Site Scripting) — attack where untrusted user input is rendered as HTML/JS in someone else's browser session. Mitigated by output encoding + CSP.

Y

  • YARP (Yet Another Reverse Proxy) — Microsoft's first-party reverse proxy library, used for BFFs and gateways.