Request lifecycle

An HTTP request passes through more than an action. Understand the entire flow before choosing where to place a policy.

Processing order#

Admission ve request deadline
  → Effective CORS policy / preflight
  → Request DI scope
  → Session middleware
  → Global CSRF
  → Global middleware
  → Handler route resolution
  → Controller middleware
  → Action middleware
  → Action guards
  → Typed extraction
  → Action
  → Response conversion / normal middleware return
  → Lazy body production and transport writing
  → Request resources and scope cleanup

Session and CSRF steps run when configured. Guards run in the order declared on the action. Typed extraction comes after guards.

Preflight versus routing#

The effective CORS policy is selected at the transport level before handler dispatch. A valid preflight request can complete without entering general middleware or a guard. Do not assume a rate limit in general middleware also applies to preflight.

An action guard applies only to requests that reach that action. Results such as 404 and 405 may not pass through that guard.

Middleware return order#

Middleware wraps requests in forward order and normal returns in reverse order. Code after next.run(exchange).await observes the downstream operation's normal return. It does not establish that the streaming body has been fully delivered to the client.

When does the request scope end?#

A lazy response or SSE producer can continue running after the handler returns. Termination of the associated request resources and scope cleanup are coordinated. Do not equate resource cleanup with the instant the handler returns.

Termination cleanup is a separate contract for middleware calls interrupted abnormally. It is not a general finally that runs for both Ok and Err on normal return.