Web API Anti-Patterns That Break Production Applications

var users = await _context.Users
    .Include(x => x.Orders)
    .Include(x => x.Payments)
    .Include(x => x.Addresses)
    .ToListAsync();

Problems

• Huge payloads

• Slow SQL

• Memory pressure

Better Approach

Project only required fields:

var users = await _context.Users
    .Select(u => new UserListDto
    {
        Id = u.Id,
        Name = u.Name
    })
    .ToListAsync();

7. Missing API Versioning

Anti-Pattern

Deploying breaking changes directly.

/api/customers

Result

Existing consumers suddenly fail.

Better Approach

/api/v1/customers
/api/v2/customers

Or use header-based versioning.

8. No Request Validation

Anti-Pattern

public async Task<IActionResult> Create(UserRequest request)
{
    // directly process
}

Problems

• Invalid data enters system

• Database corruption

• Unexpected exceptions

Better Approach

Use:

[ApiController]

and FluentValidation:

RuleFor(x => x.Email)
    .NotEmpty()
    .EmailAddress();

9. Ignoring Cancellation Tokens

Anti-Pattern

public async Task<IActionResult> Get()
{
    await _service.ProcessAsync();
}

Problem

Work continues even after:

• Browser closes

• Mobile app disconnects

• Load balancer times out

Better Approach

public async Task<IActionResult> Get(
    CancellationToken ct)
{
    await _service.ProcessAsync(ct);
}

10. Logging Too Little or Too Much

Too Little

_logger.LogError("Error");

No context.

Too Much

_logger.LogInformation(JsonSerializer.Serialize(request));

May expose:

• Passwords

• Tokens

• PII

Better Approach

Structured logging:

_logger.LogInformation(
    "Creating order {OrderId} for customer {CustomerId}",
    orderId,
    customerId);

11. No Rate Limiting

Anti-Pattern

API accepts unlimited requests.

Risks

• DDoS attacks

• Resource exhaustion

• Database overload

Better Approach (.NET 7+)

builder.Services.AddRateLimiter(...);

app.UseRateLimiter();

Protect critical endpoints.

12. Ignoring Health Checks and Observability

Anti-Pattern

You only discover problems after customers complain.

Missing Components

• Health checks

• Metrics

• Tracing

• Dashboards

Better Approach

builder.Services.AddHealthChecks();
app.MapHealthChecks("/health");

Add:

• OpenTelemetry

• Application Insights

• Prometheus

• Grafana

for proactive monitoring.

Production-Ready API Checklist

✅ Proper HTTP status codes
✅ Global exception handling
✅ Async all the way
✅ Thin controllers
✅ DTOs instead of entities
✅ Request validation
✅ API versioning
✅ Cancellation tokens
✅ Structured logging
✅ Rate limiting
✅ Health checks
✅ Observability & tracing

The majority of production API issues in .NET applications are not caused by complex algorithms. They're caused by these architectural and operational anti-patterns that quietly accumulate until traffic, scale, or failures expose them. Fixing them early dramatically improves reliability, performance, and maintainability.

Conclusion

In this article, I have tried to cover Difference Between Controller and ControllerBase in ASP.NET Core.