ASP.NET Core MVC Interview Question #196

How would you implement optimistic UI actions without weakening server security?

Senior Practical MVC Scenarios & Production Architecture Senior Advanced

Quick Interview Answer

JavaScript may update the interface immediately for responsiveness, but the server remains authoritative. Every state-changing request must still enforce authentication, authorization, anti-forgery protection when relevant, validation, and business rules.

Detailed Explanation

If the server rejects the operation, the client must reconcile or revert the optimistic state. Never assume that a disabled button or client-side permission check prevents a malicious request.

Code Example

const response = await fetch('/Favorites/Add/10', {
    method: 'POST',
    headers: { 'RequestVerificationToken': token }
});

if (!response.ok) {
    // Revert optimistic UI and show an error.
}