| | | 1 | | using ProjectTemplate.Web.Authentication.Extensions; |
| | | 2 | | using ProjectTemplate.Web.ErrorHandling; |
| | | 3 | | |
| | | 4 | | namespace ProjectTemplate.Web.Extensions; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// Provides extension methods to configure the application's middleware pipeline |
| | | 8 | | /// with a predefined ordering suitable for this template. |
| | | 9 | | /// </summary> |
| | | 10 | | public static class PipelineExtensions |
| | | 11 | | { |
| | | 12 | | /// <summary> |
| | | 13 | | /// Configures the middleware pipeline for the specified <see cref="WebApplication"/>. |
| | | 14 | | /// The ordering includes forwarded headers, request logging, exception handling, |
| | | 15 | | /// security headers, HTTPS redirection, static files, routing, rate limiting, and |
| | | 16 | | /// (optionally) authentication/authorization and endpoint mapping. |
| | | 17 | | /// </summary> |
| | | 18 | | /// <param name="app">The <see cref="WebApplication"/> to configure.</param> |
| | | 19 | | /// <returns>The same <see cref="WebApplication"/> instance for chaining.</returns> |
| | | 20 | | public static WebApplication UseApplicationPipeline(this WebApplication app) |
| | | 21 | | { |
| | | 22 | | // 1. Proxy/load balancer correction must happen early. |
| | 148 | 23 | | app.UseApplicationForwardedHeaders(); |
| | | 24 | | |
| | | 25 | | // 2. Structured request logging should see corrected scheme, host, and client IP. |
| | 142 | 26 | | app.UseApplicationRequestLogging(); |
| | | 27 | | |
| | | 28 | | // 3. Centralized exception handling. |
| | 142 | 29 | | app.UseApplicationErrorHandling(); |
| | 142 | 30 | | app.UseProblemDetails(); |
| | | 31 | | |
| | | 32 | | // 4. Optional security response headers. |
| | 142 | 33 | | app.UseApplicationSecurityHeaders(); |
| | | 34 | | |
| | | 35 | | // 5. HTTPS enforcement. |
| | 142 | 36 | | app.UseHttpsRedirection(); |
| | | 37 | | |
| | | 38 | | // 6. Static files before routing if using MVC/Razor UI. |
| | 142 | 39 | | app.UseStaticFiles(); |
| | | 40 | | |
| | | 41 | | // 7. Routing. |
| | 142 | 42 | | app.UseRouting(); |
| | | 43 | | |
| | | 44 | | // 8. CORS, when needed, should be after routing and before auth. |
| | 142 | 45 | | app.UseCors(); |
| | | 46 | | |
| | | 47 | | // 9. Rate limiting after routing when endpoint-specific policies are used. |
| | 142 | 48 | | app.UseRateLimiter(); |
| | | 49 | | |
| | | 50 | | // 10. Authentication and authorization. |
| | 142 | 51 | | app.UseApplicationAuthentication(); |
| | 128 | 52 | | app.UseAuthorization(); |
| | | 53 | | |
| | | 54 | | // 11. Endpoint mapping. |
| | 128 | 55 | | app.MapControllers(); |
| | 128 | 56 | | app.MapRazorPages(); |
| | | 57 | | |
| | 128 | 58 | | return app; |
| | | 59 | | } |
| | | 60 | | } |
| | | 61 | | |