Direct answer

ASP.NET Core can deliver complete server-rendered HTML through Razor Pages, MVC views, or other endpoint handlers.

What to remember
  • Middleware order changes behavior.
  • ASP.NET Core endpoint routing maps requests to endpoints.
  • A Razor layout can define: For each indexable page, supply: specific title; specific description; absolute canonical; robots policy; Open Graph URL; structured data where relevant.

01

Definition

Direct answer.

ASP.NET Core can deliver complete server-rendered HTML through Razor Pages, MVC views, or other endpoint handlers.

The framework also relies on ordered middleware for:

  • forwarded headers;
  • HTTPS redirection;
  • static files;
  • routing;
  • authentication;
  • authorization;
  • status code pages;
  • exception handling.[1]

A search-safe deployment needs one coherent public request contract across the reverse proxy and application.

What to remember.

  • Middleware order changes behavior.
  • Forwarded headers should be trusted only from known proxies and networks.[2]
  • Absolute URLs must use the public HTTPS host, not an internal container address.
  • Status-code pages should preserve the original error status.
  • A development response does not prove the edge deployment is correct.

Routing defines the page inventory.

ASP.NET Core endpoint routing maps requests to endpoints.[3]

Inventory:

  • Razor Pages;
  • MVC actions;
  • minimal API endpoints;
  • redirects;
  • static files;
  • admin;
  • authentication;
  • health checks;
  • catch-all routes.

Use stable route names or route values for internal URL generation.

Do not hard-code paths in views when routing helpers can generate them.

02

Mechanism

Canonical metadata.

A Razor layout can define:

<title>@ViewData["Title"]</title>
<meta name="description" content="@ViewData["Description"]" />
<link rel="canonical" href="@ViewData["Canonical"]" />

For each indexable page, supply:

  • specific title;
  • specific description;
  • absolute canonical;
  • robots policy;
  • Open Graph URL;
  • structured data where relevant.

Do not default every missing canonical to the homepage.

Forwarded headers.

Reverse proxies commonly terminate TLS and forward the request to Kestrel over an internal connection.

The application needs trusted information about:

  • original scheme;
  • host;
  • client IP;
  • prefix where applicable.

Microsoft documents Forwarded Headers Middleware for this purpose.[2]

A wrong scheme can produce:

  • HTTP canonical on HTTPS page;
  • redirect loop;
  • insecure cookie behavior;
  • wrong absolute URL;
  • incorrect authentication callback.

Known proxies and networks.

Recent ASP.NET Core servicing changes ignore forwarded headers from unknown proxies under the documented security model.[4]

Configure the actual trusted proxy or network.

Do not clear trust restrictions merely to stop a redirect loop.

A spoofed forwarded host or scheme can contaminate canonical and security behavior.

Middleware order.

A typical pipeline can include:

Forwarded Headers
Exception Handler
HSTS
HTTPS Redirection
Static Files
Routing
Authentication
Authorization
Endpoints
Status Code Pages

The exact order depends on the app and current Microsoft guidance.[1]

Test the result rather than copying one generic snippet across every deployment.

If HTTPS redirection runs before the application understands the original proxy scheme, the request can loop.

03

Examples

Redirects.

For permanent URL moves, use an explicit permanent redirect response.

Check:

  • status;
  • Location;
  • method behavior;
  • host;
  • path base;
  • query preservation;
  • one-hop destination.

Separate infrastructure HTTPS redirection from content migration redirects.

Do not build chains through several middleware components.

404 handling.

ASP.NET Core status code pages can generate bodies for error responses without changing the underlying status when configured correctly.[5]

Test:

/nonexistent-route
/nonexistent-record
/old-route

Verify:

  • 404 status;
  • useful body;
  • no homepage canonical;
  • no redirect to homepage;
  • no developer stack trace.

A friendly error page returning 200 is still a soft-error defect.

Exception handling.

Production exception handling should return an appropriate 5xx response and a safe body.

Do not expose stack traces.

Do not convert every exception into a 200 page.

Monitor:

  • endpoint;
  • trace identifier;
  • response status;
  • upstream dependency;
  • deployment version.

04

Boundaries

PathBase and subpath hosting.

An application can be hosted under a subpath:

https://example.com/knowledge/

Ensure routing, static files, redirects, canonical URLs, and generated links include the public PathBase.

A proxy that strips the prefix must communicate it consistently or the app must be configured explicitly.

Static files and assets.

Test:

  • CSS;
  • JavaScript;
  • images;
  • cache headers;
  • fingerprinting;
  • content types;
  • fallback behavior.

Primary HTML should remain useful when optional enhancement scripts fail.

Do not route missing assets into the application shell under 200.

Release checklist.

  • Public endpoints inventoried.
  • URL generation uses routing helpers.
  • Canonical uses public HTTPS origin.
  • Forwarded headers run in correct order.
  • Known proxies and networks configured.
  • HTTPS redirection tested behind the proxy.
  • Content redirects are direct and explicit.
  • Missing records return 404.
  • Exceptions return 5xx.
  • Status code pages preserve status.
  • PathBase tested.
  • Static assets return correct content types.
  • Public edge and origin compared.
  • URL Inspection sampled.

Evidence limits.

ASP.NET Core versions and hosting models evolve. Middleware, Kestrel, IIS, YARP, cloud load balancers, and application code jointly determine the public response. Framework use does not guarantee indexing or ranking.

References

Sources behind this record

  1. ASP.NET Core Middleware — Microsoft Learn (accessed August 5, 2026)
  2. Configure ASP.NET Core to work with proxy servers and load balancers — Microsoft Learn (accessed August 5, 2026)
  3. Routing in ASP.NET Core — Microsoft Learn (accessed August 5, 2026)
  4. Forwarded Headers Middleware ignores X-Forwarded headers from unknown proxies — Microsoft Learn (accessed August 5, 2026)
  5. Handle errors in ASP.NET Core — Microsoft Learn (accessed August 5, 2026)

Corrections

Correction history

No corrections recorded.

To report an error, use the public corrections path.

Claim limit

ASP.NET Core versions and hosting models evolve. Middleware, Kestrel, IIS, YARP, cloud load balancers, and application code jointly determine the public response. Framework use does not guarantee indexing or ranking.