ASP.NET Core

ASP.NET Core MVC is a patterns-based framework for building dynamic websites and HTTP services. It enables a clean separation of concerns and provides full control over markup. The framework is designed for agile development and supports the latest web standards, making it suitable for Test-Driven Development (TDD).

Key capabilities include:

• Building both web pages and HTTP services within a single aligned framework.
• Hosting options include IIS or self-hosting within your own process.
• Support for sophisticated applications using modern web standards.

The dotnet/aspnetcore repository is undergoing a consolidation process with dotnet/aspnetcore-tooling. The primary objectives are to:

1. Reduce overall build time for the .NET Core SDK.
2. Reduce maintenance complexity by consolidating multiple repositories into one.
3. Maintain or improve developer productivity.

The migration follows a multi-phase approach, starting with language components (Phase One) followed by a gradual migration of remaining tooling components (Phase Two).

The ASP.NET Core security area provides the core components for managing user identity and access control. It is organized into several functional areas:

• Authentication: Components used for identifying a user.
• Authorization: Components used for determining if a user has the required permissions.
• CookiePolicy: Middleware that enforces security attributes on response cookies.

Note: ASP.NET Core does not include Basic Authentication middleware by default due to security and performance concerns. If you require Basic Authentication while hosting under IIS, it should be enabled via IIS configuration instead.

ASP.NET Core provides a variety of authentication handlers to support different security protocols and identity providers. These handlers allow you to implement authentication for client certificates, cookies, OAuth2, OpenID Connect, and more.

Available handler types include:

• Certificate: For client certificate authentication.
• Cookies: For cookie-based authentication.
• Facebook, Google, MicrosoftAccount, Twitter: OAuth2/OAuth1a handlers for specific social providers.
• JwtBearer: An OpenID Connect based JWT bearer authentication handler.
• Negotiate: For Kerberos/Negotiate/NTLM authentication used with the Kestrel server.
• OAuth: A generic OAuth2 authentication handler.
• OpenIdConnect: For interactive OpenID Connect clients.
• WsFederation: For interactive WS-Federation clients.

ASP.NET Core Data Protection provides APIs for protecting and unprotecting data. It is designed to handle the complexities of cryptography, such as key management, rotation, and storage, so developers can focus on securing sensitive information.

The system is composed of several key components:

• Abstractions: Defines the core interfaces used by consumers, specifically IDataProtectionProvider and IDataProtector.
• DataProtection: The primary implementation used by ASP.NET Core applications.
• Storage Providers: Implementations for persisting keys in different environments, including:
  • EntityFrameworkCore: For storing keys using Entity Framework Core.
  • StackExchangeRedis: For storing keys using StackExchange.Redis.
• Cryptography: Internal infrastructure for key derivation (e.g., PBKDF2) and general cryptographic operations.

The Microsoft.AspNetCore.Identity.UI package provides a pre-built Razor Pages-based user interface for managing identity-related tasks. Key features include:

• User registration and login functionality: Standard flows for creating and accessing accounts.
• Account management: Interfaces for users to manage their profile and settings.
• Two-factor authentication (2FA): Support for securing accounts with an additional layer of verification.

ASP.NET Core provides abstractions and implementations for localizing applications. This includes support for localized views, localized strings in data annotations, and the ability to create custom localization resources. The system relies on two main components:

1. Localization Providers: These implement RequestCultureProvider to determine the culture information (e.g., language, region) of an incoming HttpRequest.
2. Localization Resources: These implement IStringLocalizer to fetch the actual localized strings for the application.

You can use built-in implementations or extend the system using community-provided providers and resource fetchers.

The Http directory provides the core HTTP abstractions used throughout ASP.NET Core. This includes the fundamental object models for handling web requests and responses, as well as the routing infrastructure.

Key components include:

• Core HTTP Models: HttpContext, HttpRequest, HttpResponse, and RequestDelegate.
• Endpoint Routing: Middleware and abstractions for routing requests to application logic and generating links.
• WebUtilities: Utilities for working with forms, multipart messages, and query strings.
• Authentication: Abstractions and core types used by authentication middleware.
• Results: Implementations of IResult and related types for handling response generation.