Networking & communication protocols

// TCP: connect first, then a reliable ordered stream
using var tcp = new TcpClient();
await tcp.ConnectAsync("core-banking.internal", 9000, ct);
await using var stream = tcp.GetStream();
await stream.WriteAsync("PING\n"u8.ToArray(), ct);

// UDP: no connection, no delivery guarantee
using var udp = new UdpClient();
await udp.SendAsync("payments.count:1|c"u8.ToArray(), "statsd.internal", 8125, ct);

TCP is a stream, not messages: one ReadAsync can return half a message or two. Add framing (length prefix or delimiter), or let System.IO.Pipelines help.

builder.WebHost.ConfigureKestrel(k =>
    k.ListenAnyIP(5001, listen =>
    {
        listen.Protocols = HttpProtocols.Http1AndHttp2AndHttp3;
        listen.UseHttps();                      // HTTP/2 and HTTP/3 in browsers need TLS
    }));

builder.Services.AddHttpClient("payments", c =>
{
    c.BaseAddress = new Uri("https://payments.internal/");
    c.DefaultRequestVersion = HttpVersion.Version30;
    c.DefaultVersionPolicy = HttpVersionPolicy.RequestVersionOrLower; // fall back to 2 or 1.1
});

var lookup = new LookupClient();                      // DnsClient
var result = await lookup.QueryAsync("bank.com", QueryType.MX);
foreach (var mx in result.Answers.MxRecords())
    Console.WriteLine($"{mx.Preference} {mx.Exchange}");

// A singleton HttpClient that still follows DNS changes
var http = new HttpClient(new SocketsHttpHandler
{
    PooledConnectionLifetime = TimeSpan.FromMinutes(2)
});

A static HttpClient without PooledConnectionLifetime keeps its old connections and never sees a DNS change. IHttpClientFactory avoids this by recycling handlers.

AS2/AS4 has no well-known free .NET library. It is usually handled by an MFT or B2B gateway product, not app code.

// SSE: push price updates to the browser
app.MapGet("/prices", (PriceFeed feed, CancellationToken ct) =>
    TypedResults.ServerSentEvents(feed.StreamAsync(ct), eventType: "price"));

// Webhook: verify the HMAC signature, reply 2xx fast, process later
app.MapPost("/webhooks/payments", async (HttpRequest req, IConfiguration cfg, Channel<byte[]> inbox) =>
{
    using var ms = new MemoryStream();
    await req.Body.CopyToAsync(ms);
    var body = ms.ToArray();
    var expected = HMACSHA256.HashData(Encoding.UTF8.GetBytes(cfg["Webhook:Secret"]!), body);
    var given = Convert.FromHexString(req.Headers["X-Signature"].ToString());
    if (!CryptographicOperations.FixedTimeEquals(expected, given))
        return Results.Unauthorized();
    await inbox.Writer.WriteAsync(body);         // a worker does the real work
    return Results.Ok();
});

Compare signatures with FixedTimeEquals, never == or SequenceEqual, which leak timing. Also check a timestamp header to block replays.

// System.Text.Json source generation: no reflection, AOT-safe, faster
[JsonSerializable(typeof(Payment))]
[JsonSourceGenerationOptions(PropertyNamingPolicy = JsonKnownNamingPolicy.CamelCase)]
internal partial class AppJsonContext : JsonSerializerContext { }

var json = JsonSerializer.Serialize(payment, AppJsonContext.Default.Payment);

// ISO 20022: validate the XML against the official XSD before using it
var settings = new XmlReaderSettings { ValidationType = ValidationType.Schema };
settings.Schemas.Add(null, "pacs.008.001.08.xsd");
using var reader = XmlReader.Create(stream, settings);    // throws on an invalid message
var doc = (Document)new XmlSerializer(typeof(Document)).Deserialize(reader)!;

ISO 8583 (cards) has no standard Microsoft or widely used open-source .NET library. It is normally handled by the card switch or a vendor SDK.