How does the Middleware Pipeline work in ASP.NET Core, and why is registration order critical?

Short answer

Each middleware runs code before calling next(), then waits for the response to return; order matters because UseAuthentication must come before UseAuthorization.

Explanation

The Pipeline is built as nested RequestDelegate functions. If UseAuthorization runs before UseAuthentication, permissions are checked before user identity is verified and requests may fail with 401 or 403. The general order is error handling (UseExceptionHandler), then routing and CORS, authentication, authorization, and finally Endpoints.

Code example

app.UseExceptionHandler("/error");
app.UseRouting();
app.UseCors();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

Common mistakes

• Placing app.UseCors() at the end of the pipeline after routing and authentication, preventing CORS headers from being sent for authentication errors.

Follow-up questions

• What are the five ASP.NET Core Controller Filter stages, and in what order do they run?

Sources

• Microsoft Learn — ASP.NET Core Middleware