Middleware order and short-circuiting

Four methods shape a pipeline:

• app.Use(...) adds a component that may call next or not.
• app.Run(...) adds a terminal component; it has no next to call.
• app.Map("/admin", branch => ...) sends requests whose path starts with that segment into a separate pipeline that never rejoins the main one. The matched segment moves from Request.Path to Request.PathBase.
• app.UseWhen(predicate, branch => ...) runs extra components when the predicate holds, then rejoins the main pipeline.

Short-circuiting

A component that writes a response and does not call next short-circuits the request. Nothing deeper runs, but every component that already ran still executes its code after next and sees the response on the way out. Authorization answering 401, the static-file middleware serving site.css, and a rate limiter answering 429 all work this way. The model below builds a three-component pipeline from plain delegates and sends an anonymous and a signed-in request through it.

Order is behaviour

A typical Program.cs reads:

app.UseExceptionHandler("/error");
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseCors();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

Each position has a reason. The exception handler is first because it can only catch exceptions thrown by components inside it. Static files come before authorization, so a file it finds is served without any authorization check; that is intended for public assets and a leak for anything that is not. Authentication must come before authorization, because authentication is what turns the request's credentials into context.User, and authorization only reads it.

The second model puts a try/catch component, standing in for the exception handler, in two positions.

An exception travels outward through the components that called next. A catch registered after the thrower is deeper in the onion, so the exception never passes through it.

Common mistakes

• Calling UseAuthorization() before UseAuthentication(). When authorization runs, context.User is still anonymous, so [Authorize] endpoints answer 401 to callers with a perfectly good token (unless the policy names its own authentication schemes, which authorization then runs itself).
• Registering the exception handler after other middleware; exceptions from the components before it escape (the second model).
• Using StartsWith for a path check in custom middleware. /admin then also matches /administration; compare on a segment boundary as Map does.
• Choosing Map when you meant UseWhen. A Map branch never returns to the main pipeline, so endpoints after it are unreachable for that path.

What interviewers ask

• Order these: authentication, authorization, routing, exception handling, static files. Why? Exception handling outermost; static files early to short-circuit cheaply; routing before auth so the endpoint's metadata is known; authentication before authorization.
• may call ; is terminal; branches on a path prefix and never rejoins.