ASP.NET Core request pipeline: Kestrel, middleware order, routing and endpoints

// ======================================================================
// Q: What happens to an HTTP request in ASP.NET Core?
//
// Middleware order matters. Common mistakes: UseAuthorization before
// UseAuthentication, or CORS after authentication.
// ======================================================================

Kestrel → middleware pipeline → routing → endpoint → response (back through the same middleware)

app.UseExceptionHandler();     // 1. first: catches the errors of everything after it
app.UseHsts();
app.UseHttpsRedirection();
app.UseStaticFiles();          // static files without auth and routing
app.UseRouting();
app.UseCors();
app.UseAuthentication();       // who you are (before authorization)
app.UseAuthorization();        // what is allowed
app.UseRateLimiter();
app.MapControllers();          // endpoint: model binding → filters → action