ASP.NET Core MVC Interview Question #193

How would you implement audit logging for important MVC operations?

Senior Practical MVC Scenarios & Production Architecture Senior Advanced

Quick Interview Answer

Record meaningful security or business events at the application boundary, including the authenticated actor, operation, target identifier, timestamp, and relevant outcome. For sensitive systems, store audit records in a durable location designed for the required retention and tamper-resistance properties.

Detailed Explanation

Do not store passwords, tokens, or unnecessary sensitive content in audit logs. Audit logging is distinct from ordinary diagnostic logging because it answers who performed an important action and what happened.

Code Example

await _audit.WriteAsync(new AuditEntry
{
    UserId = User.FindFirstValue(
        ClaimTypes.NameIdentifier),
    Action = "Product.Publish",
    EntityId = product.Id.ToString(),
    OccurredAtUtc = DateTime.UtcNow
});