Bits of .NET

The #1 misunderstood part of ASP.NET Core is middleware order.

❌ Bad Order Example

app.UseAuthentication();
app.UseRouting();
app.UseAuthorization();

Authentication runs BEFORE routing → user can’t be authorized → random 401s.

✔ Correct Order

app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(...);

💡 Life-Saving Insight

Routing must ALWAYS come first.
Authorization must ALWAYS come after Authentication.

Confusing ordering makes APIs randomly break.