| | | 1 | | using ProjectTemplate.Web.Authentication.Extensions; |
| | | 2 | | using ProjectTemplate.Web.ErrorHandling; |
| | | 3 | | |
| | | 4 | | namespace ProjectTemplate.Web.Extensions; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// Provides extension methods to configure the application's middleware pipeline |
| | | 8 | | /// with a predefined, order-sensitive sequence suitable for this template. |
| | | 9 | | /// </summary> |
| | | 10 | | public static class PipelineExtensions |
| | | 11 | | { |
| | | 12 | | /// <summary> |
| | | 13 | | /// Configures the middleware pipeline for the specified <see cref="WebApplication"/>. |
| | | 14 | | /// The ordering includes forwarded headers, request logging, exception handling, |
| | | 15 | | /// security headers, HTTPS redirection, static files, routing, rate limiting, and |
| | | 16 | | /// (optionally) authentication/authorization and endpoint mapping. |
| | | 17 | | /// </summary> |
| | | 18 | | /// <param name="app">The <see cref="WebApplication"/> to configure.</param> |
| | | 19 | | /// <returns>The same <see cref="WebApplication"/> instance for chaining.</returns> |
| | | 20 | | public static WebApplication UseApplicationPipeline(this WebApplication app) |
| | | 21 | | { |
| | | 22 | | // Keep this sequence aligned with ADR-0002 and the middleware documentation. |
| | | 23 | | // Move order-sensitive middleware only after reviewing the documented invariants. |
| | | 24 | | |
| | | 25 | | // 1. Proxy/load balancer correction must happen early. |
| | 160 | 26 | | app.UseApplicationForwardedHeaders(); |
| | | 27 | | |
| | | 28 | | // 2. Structured request logging should see corrected scheme, host, and client IP. |
| | 154 | 29 | | app.UseApplicationRequestLogging(); |
| | | 30 | | |
| | | 31 | | // 3. Centralized exception handling. |
| | 154 | 32 | | app.UseApplicationErrorHandling(); |
| | 154 | 33 | | app.UseProblemDetails(); |
| | | 34 | | |
| | | 35 | | // 4. Optional security response headers. |
| | 154 | 36 | | app.UseApplicationSecurityHeaders(); |
| | | 37 | | |
| | | 38 | | // 5. HTTPS enforcement. |
| | 154 | 39 | | app.UseHttpsRedirection(); |
| | | 40 | | |
| | | 41 | | // 6. Static files before routing if using MVC/Razor UI. |
| | 154 | 42 | | app.UseStaticFiles(); |
| | | 43 | | |
| | | 44 | | // 7. Routing. |
| | 154 | 45 | | app.UseRouting(); |
| | | 46 | | |
| | | 47 | | // 8. CORS, when needed, should be after routing and before auth. |
| | 154 | 48 | | app.UseCors(); |
| | | 49 | | |
| | | 50 | | // 9. Rate limiting after routing when endpoint-specific policies are used. |
| | 154 | 51 | | app.UseRateLimiter(); |
| | | 52 | | |
| | | 53 | | // 10. Authentication and authorization. |
| | 154 | 54 | | app.UseApplicationAuthentication(); |
| | 140 | 55 | | app.UseAuthorization(); |
| | | 56 | | |
| | | 57 | | // 11. Endpoint mapping. |
| | 140 | 58 | | app.MapControllers(); |
| | 136 | 59 | | app.MapRazorPages(); |
| | | 60 | | |
| | 136 | 61 | | return app; |
| | | 62 | | } |
| | | 63 | | } |