.NET Virtual User Group

## Bugs Live at the Seams: Integration Testing with WebApplicationFactory, Test containers, and Real Auth

Most production bugs don't live inside a single function — they live at the seams, where your code hands off to the database, crosses the auth pipeline, or turns JSON into an object. Unit tests, built on mocks, can't reach those seams, because a mock is only an assumption about how the real thing behaves.

This talk builds, piece by piece, a single integration test that hits a real ASP.NET Core minimal API over real HTTP and asserts on a real response — no mocks, no hand-rolled tokens. Using WebApplicationFactory and Testcontainers, we'll design a fixture lifecycle with four explicit, self-checking phases (start the database, build the factory, materialize the host, seed), and see why composition — not inheritance — is the right tool for running the exact same test body against both SQLite and a real PostgreSQL container, with zero duplicated logic.

We'll fake authentication while keeping authorization completely real, using a swappable scheme and a fluent builder (WithJwtAuth, WithCookieAuth, AsAdmin()) that turns identity into a one-line, readable test setup — including first-class CSRF/antiforgery testing for cookie-based auth. Along the way: deterministic timestamps via an injected TimeProvider, generated request data, and the traps that catch people off guard, from incompatible DisposeAsync signatures to captive dependencies.

You'll leave with a reusable pattern — demonstrated in a public reference repo — for integration test fixtures that are correct by construction, honest about their coverage, and cheap enough to actually write.