ASP.NET Core Request Pipeline

ASP.NET Core Request Processing Pipeline

ASP.NET Core and walk through exactly how the request processing pipeline works internally. Think of it as an assembly line for HTTP requests, where each station (middleware) can inspect, modify, or short-circuit the process before handing it to the next.

This explains how an HTTP request flows from the browser through ASP.NET Core middlewares until a response is returned.

🧩 High-Level Flow

1️⃣ Request Leaves the Browser

• A user types a URL (e.g., https://example.com/home/index) or clicks a link.
• The browser creates an HTTP request and sends it over the internet.

2️⃣ Request Reaches the Server

• In production, a reverse proxy like IIS, Nginx, or Apache may receive the request first.
• The reverse proxy may handle SSL/TLS, load balancing, logging, then forward the request to Kestrel.
• In development, the request usually goes directly to Kestrel.

3️⃣ Kestrel (Web Server)

• Kestrel is the built-in ASP.NET Core web server.
• It accepts the HTTP request and passes it to the middleware pipeline.

4️⃣ Middleware Pipeline Execution

The middleware pipeline is defined in Program.cs or Startup.Configure. Each middleware can inspect, modify, or short-circuit the request. Example sequence for a typical MVC/Web API app:

1. Exception Handling — catches unhandled errors.
2. HSTS / HTTPS Redirection — enforces secure HTTPS connections.
3. Static Files — serves CSS, JS, and images directly.
4. Routing — prepares request routing.
5. Authentication — validates the user identity.
6. Authorization — checks user permissions.
7. Endpoint Execution — executes the controller, Razor Page, or Minimal API.

5️⃣ Your Application Logic

• The controller or endpoint runs business logic.
• It may query databases or call external services.
• A response (HTML, JSON, file, etc.) is generated.

6️⃣ Response Travels Back Out

• The response flows back through the middleware pipeline in reverse order.
• Middleware can add headers, compress content, or log responses.
• Kestrel sends the response to the client.

7️⃣ Browser Receives Response

• The browser renders HTML pages.
• Or processes JSON/data if it was an API call.

🔍 Internal Mechanics

RequestDelegate Chain Internally, the pipeline is a chain of RequestDelegate functions. Each middleware receives:

Task InvokeAsync(HttpContext context, RequestDelegate next)

• context → Holds request/response data.
• next → Calls the next middleware in the chain.

Short-Circuiting If a middleware doesn’t call await next(context), the pipeline stops there (e.g., app.Run(...)).

Onion Model The request goes inward through middleware layers, hits the endpoint, then comes outward through the same layers in reverse — like peeling an onion.

📜 Example Pipeline Setup

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseExceptionHandler("/error");       // 1. Global error handling
    app.UseHttpsRedirection();               // 2. Redirect HTTP → HTTPS
    app.UseStaticFiles();                    // 3. Serve static files
    app.UseRouting();                        // 4. Enable routing
    app.UseAuthentication();                 // 5. Authenticate user
    app.UseAuthorization();                  // 6. Authorize user
    app.UseEndpoints(endpoints =>            // 7. Map endpoints
    {
        endpoints.MapControllers();
    });
}

🧠 Key Things to Remember

• Order matters — middleware earlier in the pipeline can block or modify requests before they reach later components.
• Statelessness helps scaling — makes it easier to run multiple instances behind a load balancer.
• Middleware vs Filters — middleware runs for all requests; filters run inside MVC after routing.

💡 Pro Tip for Architects

When designing large APIs or SaaS platforms, keep cross-cutting concerns (logging, security, caching, compression) in middleware, and business logic in endpoints. This keeps the pipeline clean and maintainable.

🔑 Key Points

• Order of middleware matters.
• The pipeline behaves like an onion: requests go inward, responses go outward.
• Cross-cutting concerns belong in middleware.
• Business logic stays in controllers or endpoints.