Middleware pipeline order
Why does middleware order matter in ASP.NET Core, and what is a safe default order?
Answers use simple, clear English.
Quick interview answer
Middleware forms a nested pipeline; earlier middleware wraps later ones. A common order: Exception handling → HTTPS redirection → Static files → Routing → CORS → Authentication → Authorization → Endpoints. Putting auth after endpoints or exception handling too late causes security and debugging bugs.
Detailed answer
Middleware forms a nested pipeline; earlier middleware wraps later ones. A common order: Exception handling → HTTPS redirection → Static files → Routing → CORS → Authentication → Authorization → Endpoints. Putting auth after endpoints or exception handling too late causes security and debugging bugs. Authentication populates HttpContext.User; Authorization must run after it. Exception middleware should be outer-most to catch downstream failures.
Full explanation
Authentication populates HttpContext.User; Authorization must run after it. Exception middleware should be outer-most to catch downstream failures.