New features in ASP.NET Core 9.0
This article highlights the most significant changes in ASP.NET Core 9.0 and provides relevant documentation links.
blazer
This section describes new features for Blazor.
Constructor injection
Razor components now support constructor injection. In the following example, the code-behind class injects the NavigationManager service via a primary constructor:
For more information, please visit Dependency injection in ASP.NET Core Blazor | Microsoft Learn.
Websocket compression for interactive server components
Interactive server components enable compression for WebSocket connections by default and set a frame-ancestors Content Security Policy (CSP) policy to 'self', which prevents the app from being embedded in a the originating page from which the app is deployed, if compression is enabled or a configuration is provided for the WebSocket context.
Compression can be disabled by setting ConfigureWebSocketOptions to zero, which reduces the app's vulnerability to attacks but may lead to a decrease in performance.
Configure a stricter `frame-ancestors` CSP with a value of 'none' (single quotes required) that allows WebSocket compression but prevents browsers from converting the app into any arbitrary embed.
Further information can be found in the following resources:
- Guide to BlazorSignalR in ASP.NET Core
- Threat mitigation guide for ASP.NET Core Blazor interactive server-side rendering
SignalR
This section describes new functions for signal R.
Support for polymorphic types in SignalR hubs
Hub methods can now accept a base class instead of the derived class to enable polymorphic scenarios. The base type must be annotated to support polymorphism.
Minimal APIs
This section describes new features for minimal APIs.
Adding InternalServerError and InternalServerError to TypedResults
The TypedResults class is a useful tool for returning strongly typed HTTP status code-based responses from a minimal API. TypedResults now includes factory methods and types for returning "500 Internal Server Error" responses from endpoints.
Authentication and Authorization
This section describes new features for authentication and authorization.
Adjustment of OIDC and OAuth parameters
The OAuth and OIDC authentication handlers now have an AdditionalAuthorizationParameters option to facilitate customization of authorization message parameters, which are typically included as part of the redirect query string. In .NET 8 and earlier, this required a custom OnRedirectToIdentityProvider callback or an overridden BuildChallengeUrl method in a custom handler.
The previous custom code customization in .NET 8:
This can now be simplified by the following code:
Configuring the extended authentication flags of HTTP.sys
You can now HTTP_AUTH_EX_FLAG_ENABLE_KERBEROS_CREDENTIAL_CACHING - and HTTP_AUTH_EX_FLAG_CAPTURE_CREDENTIAL HTTP.sys flags Configure by using the new EnableKerberosCredentialCaching and CaptureCredentials properties of the HTTP.sys AuthenticationManager to optimize the handling of Windows authentication.
Other
The following sections describe various new features.
Endpoint metadata on the developer exception page
Attributes added to MVC actions, minimal APIs, and gRPC methods are examples of endpoint metadata. ASP.NET Core uses endpoint metadata to control endpoint behavior, such as routing, authentication and authorization, response caching, rate limiting, OpenAPI generation, and more.
.NET 9 adds metadata to the developer exception page. This new metadata information appears in the routing section along with other routing information. This information makes it easier to debug ASP.NET Core errors during development.
ASP.NET Core has many key-value collections. This improved debugging experience applies to:
- HTTP header
- Query strings
- Forms
- Cookie policy
- View data
- Route data
- Features
