# dotnet/aspnetcore architecture

> Architecture diagram of the GitHub repository dotnet/aspnetcore, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-05). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dotnet/aspnetcore
- Repository: https://github.com/dotnet/aspnetcore
- Video tour (about a minute): https://gitdiagram.com/dotnet/aspnetcore/video

## Overview

ASP.NET Core is a modular, cross-platform framework for building web and connected applications. A representative request workflow enters through a web server, is represented as an HTTP context, and can be routed through endpoint filters to a result; the supplied excerpts directly show the filter builder invoking a request delegate and executing its return value. The tree also shows substantial MVC, identity, security, real-time, caching, and component capabilities. Many of their runtime connections are not evidenced in the excerpts, so those links are omitted rather than inferred.

Main entry points: [`src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs`](https://github.com/dotnet/aspnetcore/blob/main/src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs) (Endpoint filters), [`src/Http/Http.Abstractions/src`](https://github.com/dotnet/aspnetcore/tree/main/src/Http/Http.Abstractions/src) (HTTP context), [`src/Servers`](https://github.com/dotnet/aspnetcore/tree/main/src/Servers) (Web servers), [`src/Http/Routing/src`](https://github.com/dotnet/aspnetcore/tree/main/src/Http/Routing/src) (Endpoint routing)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_http["HTTP and routing"]
  node_server["Web servers"]
  node_httpcontext["HTTP context<br/>[src]"]
  node_routing["Endpoint routing"]
  node_filterbuilder["Endpoint filters"]
end

subgraph group_mvc["MVC and rendering"]
  node_mvccontroller["MVC controllers<br/>[src]"]
  node_razorengine["Razor view engine<br/>[RazorViewEngine.cs]"]
  node_compositeviews["Composite view engine"]
end

subgraph group_components["Interactive components"]
  node_blazor["Blazor components"]
  node_componentendpoints["Component endpoints"]
  node_browserstorage["Protected browser storage"]
end

subgraph group_identity["Identity and security"]
  node_identitymanager["User management<br/>[UserManager.cs]"]
  node_authentication["Authentication handlers"]
  node_antiforgery["Antiforgery"]
  node_dataprotection["Data protection"]
end

subgraph group_services["App services"]
  node_signalr["SignalR hubs"]
  node_healthchecks["Health checks"]
  node_sqlcache[("SQL Server cache")]
  node_rediscache[("Redis cache")]
  node_localization["Localization"]
  node_openapi["OpenAPI documents"]
  node_certificate["Development certificates"]
end

node_developer(("Application developer"))

node_developer -.->|"builds on"| node_server
node_server -.->|"provides request"| node_httpcontext
node_httpcontext -.->|"routes request"| node_routing
node_routing -.->|"applies filters"| node_filterbuilder
node_filterbuilder -.->|"invokes handler"| node_mvccontroller
node_filterbuilder -->|"executes delegate"| node_httpcontext
node_filterbuilder -->|"writes return result"| node_openapi
node_compositeviews -.->|"selects view"| node_razorengine
node_componentendpoints -.->|"hosts components"| node_blazor
node_browserstorage -->|"protects stored data"| node_dataprotection
node_identitymanager -.->|"supports sign-in"| node_authentication
node_signalr -.->|"scales across nodes"| node_rediscache

click node_server "https://github.com/dotnet/aspnetcore/tree/main/src/Servers"
click node_httpcontext "https://github.com/dotnet/aspnetcore/tree/main/src/Http/Http.Abstractions/src"
click node_routing "https://github.com/dotnet/aspnetcore/tree/main/src/Http/Routing/src"
click node_filterbuilder "https://github.com/dotnet/aspnetcore/blob/main/src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs"
click node_mvccontroller "https://github.com/dotnet/aspnetcore/tree/main/src/Mvc/Mvc.Core/src"
click node_razorengine "https://github.com/dotnet/aspnetcore/blob/main/src/Mvc/Mvc.Razor/src/RazorViewEngine.cs"
click node_compositeviews "https://github.com/dotnet/aspnetcore/blob/main/src/Mvc/Mvc.ViewFeatures/src/ViewEngines/CompositeViewEngine.cs"
click node_blazor "https://github.com/dotnet/aspnetcore/tree/main/src/Components/Components/src"
click node_componentendpoints "https://github.com/dotnet/aspnetcore/tree/main/src/Components/Endpoints/src"
click node_browserstorage "https://github.com/dotnet/aspnetcore/blob/main/src/Components/Server/src/ProtectedBrowserStorage/ProtectedSessionStorage.cs"
click node_identitymanager "https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Extensions.Core/src/UserManager.cs"
click node_authentication "https://github.com/dotnet/aspnetcore/tree/main/src/Security/Authentication"
click node_antiforgery "https://github.com/dotnet/aspnetcore/tree/main/src/Antiforgery/src"
click node_dataprotection "https://github.com/dotnet/aspnetcore/tree/main/src/DataProtection/DataProtection/src"
click node_signalr "https://github.com/dotnet/aspnetcore/tree/main/src/SignalR/server"
click node_healthchecks "https://github.com/dotnet/aspnetcore/tree/main/src/HealthChecks/HealthChecks/src"
click node_sqlcache "https://github.com/dotnet/aspnetcore/tree/main/src/Caching/SqlServer/src"
click node_rediscache "https://github.com/dotnet/aspnetcore/tree/main/src/Caching/StackExchangeRedis/src"
click node_localization "https://github.com/dotnet/aspnetcore/tree/main/src/Localization/Localization/src"
click node_openapi "https://github.com/dotnet/aspnetcore/tree/main/src/OpenApi/src"
click node_certificate "https://github.com/dotnet/aspnetcore/blob/main/src/Shared/CertificateGeneration/CertificateManager.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server,node_httpcontext,node_routing,node_filterbuilder toneBlue
class node_mvccontroller,node_razorengine,node_compositeviews toneAmber
class node_blazor,node_componentendpoints,node_browserstorage toneMint
class node_identitymanager,node_authentication,node_antiforgery,node_dataprotection toneRose
class node_signalr,node_healthchecks,node_sqlcache,node_rediscache,node_localization,node_openapi,node_certificate,node_developer toneIndigo
```

## Components

### HTTP and routing

- [Web servers](https://github.com/dotnet/aspnetcore/tree/main/src/Servers): `src/Servers`
- [HTTP context](https://github.com/dotnet/aspnetcore/tree/main/src/Http/Http.Abstractions/src): `src/Http/Http.Abstractions/src`
- [Endpoint routing](https://github.com/dotnet/aspnetcore/tree/main/src/Http/Routing/src): `src/Http/Routing/src`
- [Endpoint filters](https://github.com/dotnet/aspnetcore/blob/main/src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs): `src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs`

### MVC and rendering

- [MVC controllers](https://github.com/dotnet/aspnetcore/tree/main/src/Mvc/Mvc.Core/src): `src/Mvc/Mvc.Core/src`
- [Razor view engine](https://github.com/dotnet/aspnetcore/blob/main/src/Mvc/Mvc.Razor/src/RazorViewEngine.cs): `src/Mvc/Mvc.Razor/src/RazorViewEngine.cs`
- [Composite view engine](https://github.com/dotnet/aspnetcore/blob/main/src/Mvc/Mvc.ViewFeatures/src/ViewEngines/CompositeViewEngine.cs): `src/Mvc/Mvc.ViewFeatures/src/ViewEngines/CompositeViewEngine.cs`

### Interactive components

- [Blazor components](https://github.com/dotnet/aspnetcore/tree/main/src/Components/Components/src): `src/Components/Components/src`
- [Component endpoints](https://github.com/dotnet/aspnetcore/tree/main/src/Components/Endpoints/src): `src/Components/Endpoints/src`
- [Protected browser storage](https://github.com/dotnet/aspnetcore/blob/main/src/Components/Server/src/ProtectedBrowserStorage/ProtectedSessionStorage.cs): `src/Components/Server/src/ProtectedBrowserStorage/ProtectedSessionStorage.cs`

### Identity and security

- [User management](https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Extensions.Core/src/UserManager.cs): `src/Identity/Extensions.Core/src/UserManager.cs`
- [Authentication handlers](https://github.com/dotnet/aspnetcore/tree/main/src/Security/Authentication): `src/Security/Authentication`
- [Antiforgery](https://github.com/dotnet/aspnetcore/tree/main/src/Antiforgery/src): `src/Antiforgery/src`
- [Data protection](https://github.com/dotnet/aspnetcore/tree/main/src/DataProtection/DataProtection/src): `src/DataProtection/DataProtection/src`

### App services

- [SignalR hubs](https://github.com/dotnet/aspnetcore/tree/main/src/SignalR/server): `src/SignalR/server`
- [Health checks](https://github.com/dotnet/aspnetcore/tree/main/src/HealthChecks/HealthChecks/src): `src/HealthChecks/HealthChecks/src`
- [SQL Server cache](https://github.com/dotnet/aspnetcore/tree/main/src/Caching/SqlServer/src): `src/Caching/SqlServer/src`
- [Redis cache](https://github.com/dotnet/aspnetcore/tree/main/src/Caching/StackExchangeRedis/src): `src/Caching/StackExchangeRedis/src`
- [Localization](https://github.com/dotnet/aspnetcore/tree/main/src/Localization/Localization/src): `src/Localization/Localization/src`
- [OpenAPI documents](https://github.com/dotnet/aspnetcore/tree/main/src/OpenApi/src): `src/OpenApi/src`
- [Development certificates](https://github.com/dotnet/aspnetcore/blob/main/src/Shared/CertificateGeneration/CertificateManager.cs): `src/Shared/CertificateGeneration/CertificateManager.cs`

### Other components

- **Application developer**

## Connections

- Application developer → Web servers: builds on (evidence: `README.md`)
- Web servers → HTTP context: provides request (evidence: `src/Http/Http.Abstractions/src/HttpContext.cs`)
- HTTP context → Endpoint routing: routes request (evidence: `src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs`)
- Endpoint routing → Endpoint filters: applies filters
- Endpoint filters → MVC controllers: invokes handler
- Endpoint filters → HTTP context: executes delegate (evidence: `src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs`)
- Endpoint filters → OpenAPI documents: writes return result (evidence: `src/Http/Routing/src/RequestDelegateFilterPipelineBuilder.cs`)
- Composite view engine → Razor view engine: selects view
- Component endpoints → Blazor components: hosts components
- Protected browser storage → Data protection: protects stored data (evidence: `src/Components/Server/src/ProtectedBrowserStorage/ProtectedSessionStorage.cs`)
- User management → Authentication handlers: supports sign-in
- SignalR hubs → Redis cache: scales across nodes