ASP.NET: Application framework

Understand ASP.NET and ASP.NET Core, their web application and API options, and the role of middleware in processing requests on the .NET platform.

Updated 8 September 2026

What ASP.NET is used for

ASP.NET is Microsoft’s web development family for .NET. Modern ASP.NET Core supports several application styles, including HTTP APIs, MVC applications, Razor Pages and Blazor. Older ASP.NET applications have a different runtime history, so the broad platform name is not enough to identify a version or architecture.

A team building an internal portal can choose a server-rendered interface or a separate API and client, depending on the application’s interaction and deployment requirements.

How middleware handles requests

In ASP.NET Core, middleware forms a pipeline for processing requests and responses. Components can perform work, pass control onward or end the request. Ordering matters when one component depends on information supplied by another.

For example, an authorization decision needs the correct authenticated identity. A pipeline that includes both features but places them incorrectly can behave differently from the intended design.

Planning a .NET web application

Identify the actual runtime and application style before choosing deployment instructions. Guidance for a modern ASP.NET Core API may not apply to a legacy application with different hosting requirements.

Test normal and denied access paths, redirects and proxy-aware URL generation. A working endpoint on a developer machine does not verify behaviour behind the production load balancer or authentication service.

How DNSTrace.dev detects ASP.NET

Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.

x-aspnet-version — The .NET Framework version, emitted by older configurations.
x-aspnetmvc-version — The ASP.NET MVC version, emitted by older configurations.
x-powered-by naming ASP.NET — The general framework banner.
server: Microsoft-IIS — The web server commonly in front, reported separately from the framework.

What a detection proves

The application is built on ASP.NET.

What it does not prove

That the version headers are accurate or current. They can be set manually, and their absence is common because publishing an exact framework version is discouraged as a hardening measure.

Common questions about ASP.NET

Does an ASP.NET detection identify the exact .NET version?

No. ASP.NET names a broad application family. A generic identifier cannot establish whether a site uses a particular legacy runtime or modern ASP.NET Core version.

Should a site remove x-aspnet-version?

Publishing an exact framework version narrows an attacker's search without benefiting visitors, and removing it is standard hardening guidance. DNSTrace.dev reports the header when present rather than recommending it.

Does ASP.NET Core emit these headers?

Generally not. Modern ASP.NET Core deployments are quieter, so detection often relies on the x-powered-by banner or nothing at all.

Application framework