ASP.NET Core request pipeline: Kestrel, middleware order, routing and endpoints
Middleware order matters.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | // ====================================================================== // Q: What happens to an HTTP request in ASP.NET Core? // // Middleware order matters. Common mistakes: UseAuthorization before // UseAuthentication, or CORS after authentication. // ====================================================================== Kestrel → middleware pipeline → routing → endpoint → response (back through the same middleware) app.UseExceptionHandler(); // 1. first: catches the errors of everything after it app.UseHsts(); app.UseHttpsRedirection(); app.UseStaticFiles(); // static files without auth and routing app.UseRouting(); app.UseCors(); app.UseAuthentication(); // who you are (before authorization) app.UseAuthorization(); // what is allowed app.UseRateLimiter(); app.MapControllers(); // endpoint: model binding → filters → action |