Routing and endpoint selection

How a URL is matched to code, and why route constraints matter.

UnderstandStudy an examplePractise

Understand the concept

Routing compares the incoming path and method with the defined route templates and selects an endpoint. An endpoint is the code to run combined with its metadata: [Authorize], [EnableRateLimiting], [AllowAnonymous] and so on. Middleware after selection can read that metadata, which is why authorization and rate limiting come after routing.

Templates can contain parameters: in “api/posts/{slug}” the slug value is captured. Constraints narrow a template: {id:int} matches only integers, {slug:minlength(3)} rejects short values. Constraints are not validation; their purpose is choosing the right endpoint. With no match, routing produces a 404.

When several templates match, ASP.NET Core picks the most specific: a literal segment wins over a parameter. If “api/posts/latest” and “api/posts/{slug}” coexist, ‘latest’ goes to the first. Two equally good matches cause an ambiguity error at run time.

WHEN TO USE IT

Selecting the wrong endpoint means applying the wrong authorization rule.

COMMON PITFALL

Treating route constraints as input validation and skipping real validation.

01 / PRACTICE

One topic. Three levels of depth.

Illustrative example

[Route("api/posts")]
public class PostsController : ControllerBase
{
    [HttpGet("{slug}")] public IActionResult Get(string slug) => …   // GET api/posts/ilk-yazi
    [HttpGet] public IActionResult List() => …                         // GET api/posts
}

With attribute routing the template is written on the controller and method.

This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.

02 / YOUR TURN

Try it yourself first.

There are ‘GET api/posts/{slug}’ and ‘GET api/posts/drafts’. drafts is protected with [Authorize(Roles="Admin")]. Which endpoint handles /api/posts/drafts, and why does it matter?

Show the solution and explanation

Worked solution

Sabit parça daha belirgin olduğu için 'drafts' endpoint’i seçilir ve Admin şartı uygulanır.
Şablon belirsiz olsaydı veya drafts bir slug gibi ele alınsaydı,
koruma devreye girmeyebilirdi.

Authorization rules attach to endpoints; which endpoint is selected is part of security.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.