ASP.NET Core Web API runs each HTTP request through a middleware pipeline, then dispatches it to an endpoint (a Minimal API handler or a controller action). In practice, you design a Web API by choosing where logic lives (middleware vs filters vs endpoint code), how you validate and map inputs, and how you handle errors and auth. This matters because most production issues come from cross-cutting concerns: auth, validation, versioning, serialization, and observability.

Request Flow

sequenceDiagram
  participant Client
  participant Middleware
  participant Routing
  participant Endpoint

  Client->>Middleware: Request
  Middleware->>Routing: Route match
  Routing->>Endpoint: Invoke
  Endpoint->>Middleware: Result
  Middleware->>Client: Response

Endpoint Examples

Minimal API:

var app = WebApplication.CreateBuilder(args).Build();
 
app.MapGet("/health", () => Results.Ok(new { status = "ok" }));
 
app.Run();

Controller style:

[ApiController]
[Route("api/orders")]
public sealed class OrdersController : ControllerBase
{
    [HttpGet("{id}")]
    public ActionResult<OrderDto> GetById(string id) => Ok(new OrderDto(id));
}

Questions

Where should authentication and authorization live in an ASP.NET Core API?

Put authentication and authorization in the pipeline so endpoints can assume an authenticated principal. Use middleware for auth and use endpoint metadata and policies to decide access per endpoint.

References

• ASP.NET Core web API docs — official guidance for controller-based APIs, routing, binding, validation, and response handling.
• ASP.NET Core middleware
• Routing in ASP.NET Core
• Filters in ASP.NET Core
• Minimal API filters
• OWASP API Security Top 10 2023