A production environment is the deployed runtime context where a web API serves real requests. It uses production-specific configuration, infrastructure, credentials, and security settings rather than the conveniences of development mode. section 12.3.6 section 12.4.4
Prepare production deliberately:
- Create the production database with its own login and user structure so the application can use a production connection string. section 12.3.6
- Use a password different from development; reusing credentials can turn a deployment mistake into a serious data breach. section 12.3.6
- Add appsettings.Production.json on the Windows VM after the production database is available. section 12.3.6
- Expect Swagger UI and launchSettings.json to be absent or disabled, because production favors a smaller exposed surface. section 12.4.4
Verify a deployed API
After publishing, open the deployed site and call /error/test or /cod/test directly. An HTTP 400 response at the site root can be normal when Swagger UI is not configured as the production startup page. Inspect the browser console when security policies block a test script. section 12.4.4
context.Response.Headers.Add("Content-Security-Policy",
"default-src ' self' ; script-src ' self' ' nonce-23a98b38c' ;");
A Content-Security-Policy header can allow same-origin scripts while requiring a specific nonce for an intentionally permitted inline script. section 12.4.4
