.NET Developer interview question
How do you order ASP.NET Core middleware?
ASP.NET Core middleware wraps the next component, so order defines both request and reverse response flow. Put exception handling early, routing before endpoint-dependent policies, authentication before authorization, and endpoints last.
Direct answer
What a strong answer covers
How it works
Each middleware receives the request, may do work, calls next to pass it on, and then does work again as the response flows back, so the registration order is the request order and the reverse is the response order. Exception handling goes first so it wraps everything downstream. HTTPS redirection and static files come early to short-circuit cheaply. UseRouting must precede anything that needs the matched endpoint, such as CORS with endpoint policies, authentication, and authorisation, and authentication must precede authorisation because the latter reads the identity the former established. Endpoints come last.
Example
An API placed UseAuthorization before UseAuthentication and every protected endpoint returned 401 for valid tokens, because the authorisation middleware ran before the identity was populated. Reordering to UseRouting, UseCors, UseAuthentication, UseAuthorization, MapControllers fixed it, and moving UseExceptionHandler to the top turned an unhandled exception in a custom middleware into a proper problem-details response.
Common mistakes
- Putting a response-modifying middleware after the endpoint so it never sees the response.
- Registering rate limiting after the expensive work it was meant to protect.
- Adding UseStaticFiles after authentication and authenticating every image request.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.