ASP.NET Core in .NET 10 focuses on refinement rather than reinvention. The improvements target security, observability, performance, and developer ergonomics — the areas that matter most once an application is in production.
1. The Bigger Picture: What .NET 10 Optimizes For
Core Themes in .NET 10
Stronger security defaults
Built-in observability
Efficient long-running services
Mature Minimal APIs
Production-ready Blazor
Example: Leaner Default Hosting Model
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddOpenApi();
builder.Services.AddAuthentication();
builder.Services.AddAuthorization();
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/health", () => Results.Ok("Healthy"));
app.Run();
.NET 10 continues refining the "simple by default, extensible when needed" hosting approach.
2. Modern Authentication: Moving Beyond Passwords
ASP.NET Core Identity now supports passkeys (WebAuthn) for passwordless authentication.
Configuring Identity for Passkeys
builder.Services.AddIdentity<ApplicationUser, IdentityRole>()
.AddEntityFrameworkStores<AppDbContext>()
.AddDefaultTokenProviders()
.AddWebAuthn();
Why This Matters
Eliminates password reuse
Improves phishing resistance
Reduces authentication friction
This allows teams to implement modern authentication without custom cryptography or third-party hacks.
3. Observability Becomes a First-Class Feature
ASP.NET Core now exposes richer metrics and diagnostics out of the box.
Enabling Built-In Metrics
builder.Services.AddOpenTelemetry()
.WithMetrics(metrics =>
{
metrics.AddAspNetCoreInstrumentation();
});
Custom Metrics Example
var meter = new Meter("MyApp.Metrics");
var requestCounter = meter.CreateCounter<int>("api.requests");
app.Use(async (context, next) =>
{
requestCounter.Add(1);
await next();
});
These improvements reduce reliance on custom instrumentation just to understand basic runtime behavior.
4. Smarter Memory Management for Long-Running Apps
ASP.NET Core in .NET 10 automatically releases unused pooled memory.
Kestrel Configuration Example
builder.WebHost.ConfigureKestrel(options =>
{
options.Limits.MaxConcurrentConnections = 500;
});
You no longer need aggressive manual tuning just to prevent memory creep in long-running services.
5. Blazor Improvements That Focus on Real Applications
Blazor gains polish across validation, navigation, and JavaScript interop.
Improved Form Validation
<EditForm Model="@order" OnValidSubmit="Submit">
<DataAnnotationsValidator />
<ValidationSummary />
<InputText @bind-Value="order.Customer.Name" />
<InputNumber @bind-Value="order.Quantity" />
<button type="submit">Save</button>
</EditForm>
Nested object validation now works more consistently without custom logic.
Persistent State Across Navigation
@inject PersistentComponentState State
@code {
private int counter;
protected override void OnInitialized()
{
State.TryTakeFromJson("counter", out counter);
}
public void Dispose()
{
State.PersistAsJson("counter", counter);
}
}
This reduces unnecessary reloads and improves UX.
JavaScript Interop Enhancements
await JS.InvokeVoidAsync(
"window.myLib.initialize",
new { theme = "dark", timeout = 3000 });
Interop is more flexible, making Blazor easier to integrate into existing JS-heavy applications.
6. Minimal APIs Continue to Grow — Carefully
Minimal APIs gain validation and streaming support while remaining lightweight.
Automatic Request Validation
app.MapPost("/orders", (
[FromBody] CreateOrderRequest request) =>
{
return Results.Created($"/orders/{request.Id}", request);
})
.AddValidation();
Validation failures automatically return standardized problem responses.
Server-Sent Events (SSE)
app.MapGet("/events", async context =>
{
await foreach (var message in GetEventsAsync())
{
await Results.ServerSentEvents(message)
.ExecuteAsync(context);
}
});
SSE is ideal for dashboards and live updates without WebSocket complexity.
7. OpenAPI and API Documentation Improvements
OpenAPI generation is more accurate and flexible.
YAML OpenAPI Endpoint
app.MapOpenApi("/openapi.yaml", options =>
{
options.Format = OpenApiFormat.Yaml;
});
Accessing OpenAPI Programmatically
public class OpenApiWorker(IOpenApiDocumentProvider provider)
{
public async Task RunAsync()
{
var document = await provider.GetDocumentAsync();
}
}
This enables automated documentation workflows and tooling integration.
8. More Predictable Authentication Behavior for APIs
APIs now return proper HTTP status codes instead of redirects.
Example: API-Friendly Cookie Auth
builder.Services.ConfigureApplicationCookie(options =>
{
options.Events.OnRedirectToLogin = ctx =>
{
ctx.Response.StatusCode = StatusCodes.Status401Unauthorized;
return Task.CompletedTask;
};
});
This avoids breaking API clients with unexpected HTML responses.
9. Validation APIs Become More Reusable
Validation is no longer tightly coupled to HTTP.
Shared Validation Logic
public class OrderValidator : IValidator<Order>
{
public ValidationResult Validate(Order order)
{
if (order.Quantity <= 0)
return ValidationResult.Failure("Quantity must be positive");
return ValidationResult.Success();
}
}
Reused in a Background Service
var result = validator.Validate(order);
if (!result.IsValid)
{
throw new ValidationException(result.Errors);
}
This supports clean architecture and domain consistency.
10. Should You Upgrade to .NET 10?
Recommended Upgrade Scenarios
Security-sensitive applications
Long-running APIs and services
Blazor-heavy frontends
Systems requiring deep observability
Multi-Targeting Example
<TargetFrameworks>net8.0;net10.0</TargetFrameworks>
This enables gradual migration and safer rollouts.
Conclusion
ASP.NET Core in .NET 10 focuses on operational excellence.
Security is modernized
Diagnostics are richer
Memory usage is smarter
APIs and Blazor are more robust
For teams building systems meant to last, .NET 10 is a confident, well-balanced LTS release.
Happy Coding!
Join the conversation! Your thoughts help the community grow.