ASP.NET Core MVC (and Razor Pages)
Request lifecycle
Middleware → Routing → Controller (DI) → Authorization filter → Resource filter → Model binding → Validation → Action filter → Action → Action filter → Result filter → View render → Result filter → Response. Exception filters wrap the action/result stages.
Middleware order (MVC)
app.UseExceptionHandler("/Home/Error"); app.UseHsts();
app.UseHttpsRedirection();
app.UseStaticFiles(); // or MapStaticAssets()
app.UseRouting();
app.UseCors();
app.UseAuthentication();
app.UseAuthorization();
app.UseSession();
app.MapControllerRoute("default", "{controller=Home}/{action=Index}/{id?}");Passing data
| Lifetime | |
|---|---|
Model (@model) | Request — preferred |
| ViewData / ViewBag | Request |
| TempData | Until read (one redirect) |
| Session | Across requests |
Action results
View · PartialView · ViewComponent · Json · Content · File · Redirect · RedirectToAction · LocalRedirect · NotFound · BadRequest · Unauthorized · Forbid · StatusCode.
Binding attributes
[FromQuery] [FromRoute] [FromForm] [FromBody] [FromHeader] [FromServices] [Bind("A,B")] [BindProperty] (Razor Pages).
Validation attributes
[Required] [StringLength] [MaxLength] [Range] [EmailAddress] [Phone] [Url] [Compare("Password")] [RegularExpression] [Remote] · custom ValidationAttribute · IValidatableObject.
Security checklist
Antiforgery on POST forms · [Authorize] + fallback policy · ownership checks (IDOR) · LocalRedirect for returnUrl · no Html.Raw on user input · HTTPS + HSTS · secure cookies · view models (no over-posting).