The Request Pipeline Walkthrough
"Walk me through what happens when a request hits your app." This is THE staple ASP.NET Core question — nearly every loop includes it. It's popular because it's a depth dipstick: everyone can start it, and the interviewer just watches where you run dry.
The walkthrough that scores
Give it as a pipeline story, not a component list: Kestrel accepts the connection and
builds an HttpContext. The request then flows through the middleware pipeline — an
ordered chain where each component can act, call next, and act again on the way back out.
A canonical order: exception handling first (so it wraps everything), then HTTPS redirection,
static files, routing (UseRouting — matches the request to an endpoint), then
authentication (who are you — populates HttpContext.User), then authorization (are
you allowed), and finally the endpoint itself. For MVC that means: model binding builds
your action's parameters from route/query/body, filters run around the action, the
action returns a result, and the result executes (view rendering or serialization) as the
response flows back out through the same middleware in reverse.
Two sentences of depth to have loaded: middleware is just a chain of delegates — anything
that doesn't call next short-circuits the pipeline (that's how static files avoid
running MVC). And the response path matters: an exception thrown late still passes back
through the exception middleware — which is why it goes first.
The planted scenario: order bugs
"Authentication is configured and the login works, but inside the controller
User.Identity.IsAuthenticated is false. Where do you look?"
Strong answer, in rubric shape: clarify ("cookie or JWT? does it fail for all endpoints?"),
then go straight to middleware order in Program.cs — the most common cause is
UseAuthentication() missing or placed after the endpoint executes, so nothing ever read
the token before MVC ran. Sibling bugs worth naming: UseAuthorization() before
UseAuthentication() (authorizing an anonymous principal — typically a 401 on everything),
and CORS middleware placed after routing rejects preflights. Verification: "I'd read the
pipeline top to bottom in Program.cs — order is the configuration."
The red flag the question is designed to catch: candidates who treat Program.cs as
ritual boilerplate ("I copy it from the template") and cannot connect a symptom to a line.
Follow-ups to pre-answer
- "Middleware vs filters?" Middleware sees every request and knows nothing about MVC; filters run inside MVC with action context. Cross-cutting HTTP concerns → middleware; controller-aware concerns → filters. (Lesson 3 goes deeper.)
- "Where would you add request logging with a correlation ID?" Early middleware — before anything that can fail — pushing the ID into the logging scope.
Practice prompts:
- Deliver the full walkthrough in under three minutes, out loud, no notes.
- "Static files are being served to logged-out users — is that a bug?" Reason about
where
UseStaticFilessits and what protecting files would require. - Write (or recite) your pipeline order and justify each position in one clause.