Aspnet Core
OpenAIOfficialPublished by OpenAI
- Skill
- Tool integration
- Software development
- Apache-2.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The ASP.NET Core skill provides a structured framework for developing web applications, APIs, and services. It emphasizes using current official guidance, prioritizing built-in framework features over third-party dependencies, and maintaining cohesive feature slices. The skill includes a modular reference system covering application models like Blazor, Razor Pages, MVC, and Minimal APIs, alongside essential topics such as dependency injection, security, performance, and migration strategies.
What it does
- Provides a structured workflow for starting new projects or refactoring existing ones.
- Offers focused references for different ASP.NET Core application models.
- Guides the implementation of middleware, routing, and dependency injection.
- Standardizes the approach to security, identity, and data access.
- Supports versioning, upgrades, and migration between .NET versions.
- Maps development tasks to official Microsoft documentation.
When to use it
- When building new ASP.NET Core web applications or APIs.
- When refactoring or modernizing legacy .NET codebases.
- When choosing between Minimal APIs and controller-based architectures.
- When implementing cross-cutting concerns like authentication or performance tuning.
- When migrating an application to a newer version of .NET.
Advantages
- Promotes the use of modern, idiomatic .NET patterns.
- Reduces technical debt by discouraging outdated Startup/WebHost patterns.
- Ensures consistency across different application models.
- Encourages the use of built-in framework features for better performance and maintainability.
- Provides a clear path for handling complex tasks like gRPC or background services.
Usage examples
- “How should I structure a new Minimal API project in .NET 10?”
- The agent will guide you through using route groups, keeping handlers thin, moving logic to services, and utilizing built-in validation and OpenAPI support.
- “I need to add authentication to my existing MVC application. Where do I start?”
- The agent will direct you to the security-and-identity reference to implement Identity, cookies, or bearer auth policies correctly.
- “Should I use Blazor or MVC for my new internal dashboard?”
- The agent will help you evaluate your requirements against the stack-selection reference to choose the most appropriate application model.
- “How do I upgrade my application from .NET 8 to .NET 10?”
- The agent will provide the versioning-and-upgrades reference to help identify breaking changes, obsolete APIs, and necessary configuration updates.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/openai/aspnet-core/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip aspnet-core.zip -d .agents/skills
Documentation by OpenAI
ASP.NET Core
Overview
Choose the right ASP.NET Core application model, compose the host and request pipeline correctly, and implement features in the framework style Microsoft documents today.
Load the smallest set of references that fits the task. Do not load every reference by default.
Workflow
Confirm the target framework, SDK, and current app model.
Open references/stack-selection.md first for new apps or major refactors.
Open references/program-and-pipeline.md next for
Program.cs, DI, configuration, middleware, routing, logging, and static assets.Open exactly one primary app-model reference:
Add cross-cutting references only as needed:
Open references/versioning-and-upgrades.md before introducing new platform APIs into an older solution or when migrating between major versions.
Use references/source-map.md when you need the Microsoft Learn section that corresponds to a task not already covered by the focused references.
Default Operating Assumptions
Prefer the latest stable ASP.NET Core and .NET unless the repository or user request pins an older target.
As of March 2026, prefer .NET 10 / ASP.NET Core 10 for new production work. Treat ASP.NET Core 11 as preview unless the user explicitly asks for preview features.
Prefer
WebApplicationBuilderandWebApplication. Avoid olderStartupandWebHostpatterns unless the codebase already uses them or the task is migration.Prefer built-in DI, options/configuration, logging, ProblemDetails, OpenAPI, health checks, rate limiting, output caching, and Identity before adding third-party infrastructure.
Keep feature slices cohesive so the page, component, endpoint, controller, validation, service, data access, and tests are easy to trace.
Respect the existing app model. Do not rewrite Razor Pages to MVC or controllers to Minimal APIs without a clear reason.
Reference Guide
references/_sections.md: Quick index and reading order.
references/stack-selection.md: Choose the right ASP.NET Core application model and template.
references/program-and-pipeline.md: Structure
Program.cs, services, middleware, routing, configuration, logging, and static assets.references/ui-blazor.md: Build Blazor Web Apps, choose render modes, and use components, forms, and JS interop correctly.
references/ui-razor-pages.md: Build page-focused server-rendered apps with handlers, model binding, and conventions.
references/ui-mvc.md: Build controller/view applications with clear separation of concerns.
references/apis-minimal-and-controllers.md: Build HTTP APIs with Minimal APIs or controllers, including validation and response patterns.
references/data-state-and-services.md: Use EF Core,
DbContext, options,IHttpClientFactory, session, temp data, and app state responsibly.references/security-and-identity.md: Apply authentication, authorization, Identity, secrets, data protection, CORS, CSRF, and HTTPS guidance.
references/realtime-grpc-and-background-work.md: Use SignalR, gRPC, and hosted services.
references/testing-performance-and-operations.md: Add integration tests, browser tests, caching, compression, health checks, rate limits, and deployment concerns.
references/versioning-and-upgrades.md: Handle target frameworks, breaking changes, obsolete APIs, and migrations.
references/source-map.md: Map the official ASP.NET Core documentation tree to the references in this skill.
Execution Notes
When generating new code, start from the correct
dotnet newtemplate and keep the generated structure recognizable.When editing an existing solution, follow the solution's conventions first and use these references to avoid framework misuse or outdated patterns.
When a task mentions "latest", verify the feature on Microsoft Learn or the ASP.NET Core docs repo before relying on memory.
Files
- ATTRIBUTION.mdAdded by AutoGineer870 B
- LICENSE.txt11.1 KiB
- SKILL.md5.4 KiB
- agents/openai.yaml222 B
- assets/dotnet-logo.png2.2 KiB
- references/_sections.md2.4 KiB
- references/apis-minimal-and-controllers.md3.0 KiB
- references/data-state-and-services.md2.4 KiB
- references/program-and-pipeline.md4.1 KiB
- references/realtime-grpc-and-background-work.md1.9 KiB
- references/security-and-identity.md2.9 KiB
- references/source-map.md2.0 KiB
- references/stack-selection.md3.6 KiB
- references/testing-performance-and-operations.md2.6 KiB
- references/ui-blazor.md2.4 KiB
- references/ui-mvc.md1.9 KiB
- references/ui-razor-pages.md1.9 KiB
- references/versioning-and-upgrades.md2.0 KiB
references/security-and-identity.md
Security And Identity
Primary docs:
https://learn.microsoft.com/aspnet/core/security/authentication/identity
https://learn.microsoft.com/aspnet/core/security/authorization/introduction
Security Defaults
Use the most secure authentication flow available
Keep secrets out of source code and plain configuration files
Use Secret Manager in development
Use a secure production secret store
Enforce HTTPS
Apply least privilege to users, services, and data access
Authentication And Authorization
Authentication answers who the user or caller is. Authorization answers what they can do.
Default pipeline order:
UseAuthentication()UseAuthorization()
Apply authorization at boundaries:
[Authorize]on controllers, actions, page models, or hubsRequireAuthorization()on endpoints and route groupspolicies for reusable rules
roles only when role-based checks are actually the right abstraction
Use AllowAnonymous sparingly and intentionally.
Identity
Use ASP.NET Core Identity when the app needs first-party user accounts, login flows, password management, email confirmation, MFA, or related account management.
Useful starting points:
dotnet new webapp -au Individualdotnet new mvc -au Individual
Identity guidance:
scaffold only the pages you truly need to customize
keep Identity UI updates maintainable; full scaffolding increases merge and upgrade cost
use policies and claims for authorization rather than encoding all decisions in page logic
persist data-protection keys appropriately in multi-instance deployments
On ASP.NET Core 10, Identity metrics are available for observing auth-related behavior. Use them when the app has meaningful authentication traffic or security monitoring requirements.
CSRF, CORS, And Browser Security
Use antiforgery protection for cookie-based interactive apps and form posts
Do not confuse CORS with authentication or authorization
Avoid permissive
AllowAnyOriginplus credentials combinationsTreat browser-side state as untrusted
HTTPS, HSTS, And Forwarded Headers
redirect HTTP to HTTPS
enable HSTS outside development when appropriate
configure forwarded headers correctly when behind proxies or load balancers
do not generate links or evaluate scheme-sensitive behavior before proxy headers are processed
Data Protection And Secrets
persist data-protection keys outside ephemeral local storage when the app runs on multiple instances
do not use environment variables as the preferred long-term home for production secrets when a stronger secret store is available
never check production credentials into source control
Blazor Note
For Blazor apps, read the general ASP.NET Core security guidance first and then the Blazor-specific security docs. Some Blazor security guidance adds to or supersedes the general guidance.
Requirements and compatibility
Written for: OpenAI Codex
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- OpenAI
- Publisher
- OpenAI (Official)
- Source
- openai/skills · skills/.curated/aspnet-core · commit 49f948f
- Licence
- Apache License 2.0 (redistribution allowed)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by OpenAI.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aspnet-core.zip