Documentation about how to setup your own custom controllers and routes that need to exist alongside the Umbraco pipeline

Where to put your routing logic?

There's two places you can specify your routing, depending on whether it's in the context of a package, or your own site. If it's your own site you can do it in the Configure method of Startup.cs within the WithEndpoints method call like so:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    
    app.UseUmbraco()
        .WithMiddleware(u =>
        {
            u.WithBackOffice();
            u.WithWebsite();
        })
        .WithEndpoints(u =>
        {
            // This is where to put the custom routing

            u.UseInstallerEndpoints();
            u.UseBackOfficeEndpoints();
            u.UseWebsiteEndpoints();
        });
}

If you're creating a package you won't have access to the Startup.cs file, so instead you must use a composer, for an example of this, see the example below.

User defined routes

Umbraco doesn't interfere with any user defined routes that you wish to have. Your custom routes to your own custom controllers will work perfectly and seamlessly alongside Umbraco's routes.

Custom routes within the Umbraco pipeline

For a request to be considered executing in an Umbraco context, and therefore the Umbraco pipeline, it needs to have an HTTP request feature with the type UmbracoRouteValues, all the information required for Umbraco to handle the request is stored there. The question is now, how do we add this request feature? There's three possibilities:

1. Do it completely manually - This requires that you have a custom route, controller, even middleware, and manually assign the UmbracoRouteValues as an HTTP request feature, however you see fit. To create an UmbracoRouteValues object generally requires: IUmbracoContextAccessor (to access the CleanedUmbracoUrl), IPublishedRouter (to create the IPublishedRequestBuilder), IPublishedRequestBuilder (to set the published content and to build the IPublishedRequest), IPublishedRequest to assign to the UmbracoRouteValues. As you can see this is quite a lot of work, but luckily there's some much easier ways.

2. Route a custom controller that implements the IVirtualPageController interface, assigning the UmbracoRouteValues to the HTTP requests will then be taken care of for you.

3. Route a custom controller with conventional routing, using the typical call to endpoints.MapControllerRoute, and then call .ForUmbracoPage() with an action for finding content on what MapControllerRoute returns, now UmbracoRouteValues will automatically be applied to any request to that controller.

Don't fret if this all seems a bit overwhelming, we'll be going through an example of the last two options.

Custom route with IVirtualPageController

As mentioned, with this approach we need to implement the IVirtualPageController interface, this interface only has one method FindContent which accepts an ActionExecutingContext:

IPublishedContent FindContent(ActionExecutingContext actionExecutingContext);

It can also be helpful to inherit from the UmbracoPageController since this includes some useful helper methods such as CurrentPage, do however note that it is not possible to inherit from RenderController when doing custom routes like this.

Let's create a shop controller, with an Index action showing all our products, and an Product action which will show some custom data about the product that could exists outside Umbraco. A common approach in a scenario like this is to have a "real" Umbraco node as a starting point. In this example we're going to use an empty "Products" document type to act as a list view, and "Product" document type which only contains an SKU. We also need some content based on those document types, a "Products" content node, which contains two product nodes, each with their own SKU.

After that bit of setup we can go ahead and create our shop controller which inherits from UmbracoPageController and implements IVirtualPageController, it'll look like this:

using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.AspNetCore.Mvc.ViewEngines;
using Microsoft.Extensions.Logging;
using Umbraco.Cms.Core.Models.PublishedContent;
using Umbraco.Cms.Web.Common.Controllers;

namespace RoutingDocs.Controllers
{
    public class ShopController : UmbracoPageController, IVirtualPageController
    {
        public ShopController(
            ILogger<UmbracoPageController> logger,
            ICompositeViewEngine compositeViewEngine)
            : base(logger, compositeViewEngine)
        { }
        
        public IPublishedContent FindContent(ActionExecutingContext actionExecutingContext)
        { }
    }
}

Now you'll see that FindContent is complaining because we're not returning anything yet, but let's start by creating our to action methods that FindContent will find content for.

First off we have the Index method:

[HttpGet]
public IActionResult Index()
{
    // CurrentPage (IPublishedContent) will be the content returned
    // from the FindContent method.

    // return the view with the IPublishedContent
    return View(CurrentPage);
}

This is a fairly straightforward method, we return the view with the content found by the FindContent method, which can then be used to list all the children in the view with Model.Children

Next we have our Product method:

[HttpGet]
public IActionResult Product(string id)
{
    // CurrentPage (IPublishedContent) will be the content returned
    // from the FindContent method.

    // One example of using a custom route would be to include additional
    // model information based on external services. For example, if
    // we wanted to return the stores the product is available in from
    // a custom data store.
    var dbProduct = DbContext.Products.GetBySku(id);
    var shopModel = new Product(CurrentPage)
    {
        Sku = id,
        AvailableStores = dbProduct.AvailableStores
    };

    return View(shopModel);
}

This method is a bit more interesting, here we get some extra data from a different source, in this case a DbContext, but this can be anything you want, using the id we get from the route values. We use this extra data to create a custom model, wich includes the available stores, which we then render the view with.

It's important to note that this custom model must implement IPublishedContent, to do this we inherit from the ContentModel class, in this case our model looks like this:

public class Product : ContentModel
{
    public Product(IPublishedContent content) : base(content)
    {
    }
    
    public string Sku { get; set; }
    public IEnumerable<string> AvailableStores { get; set; }
}

What's great about this is that we can use this model as a type argument when inheriting from UmbracoViewPage in our model like so:

@inherits Umbraco.Cms.Web.Common.Views.UmbracoViewPage<RoutingDocs.Models.Product>

Which makes the model typed, so we can access the available stores like so:

<ul>
    @foreach (var store in Model.AvailableStores)
    {
        <li>@store</li>
    }
</ul>

But let's get back to our controller, the last thing we need now is to implement FindContent method so we can find content for our actions and serve it to them. First we need to be able to get our content, and properties, so we need to inject IUmbracoContextAccessor and IPublishedValueFallback and save them to some fields like so:

private readonly IUmbracoContextAccessor _umbracoContextAccessor;
private readonly IPublishedValueFallback _publishedValueFallback;

public ShopController(
    ILogger<UmbracoPageController> logger,
    ICompositeViewEngine compositeViewEngine,
    IUmbracoContextAccessor umbracoContextAccessor,
    IPublishedValueFallback publishedValueFallback)
    : base(logger, compositeViewEngine)
{
    _umbracoContextAccessor = umbracoContextAccessor;
    _publishedValueFallback = publishedValueFallback;
}

Now that we have our dependencies, and our action methods, we're finally ready to implement the FindContent method:

public IPublishedContent FindContent(ActionExecutingContext actionExecutingContext)
{
   if (_umbracoContextAccessor.TryGetUmbracoContext(out var umbracoContext))
   {
        var productRoot = umbracoContext.Content.GetById(2074);
        if (productRoot!=null)
        {

            if (actionExecutingContext.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor)
            {
                // Check which action is executing
                switch (controllerActionDescriptor.ActionName)
                {
                    case nameof(Index):
                        return productRoot;

                    case nameof(Product):
                        // Get the SKU/Id from the route values
                        if (actionExecutingContext.ActionArguments.TryGetValue("id", out var sku))
                        {
                            return productRoot
                                .Children
                                .FirstOrDefault(c => c.Value<string>(_publishedValueFallback, "sku") == sku.ToString());
                        }
                        else
                        {
                            return productRoot;
                        }
                 }
            }           

            return productRoot;
        }
    }

    return null;
}

We start off by getting our product root using the UmbracoContext to get it based off its id. Next we need to figure out what action is being requested, to do this we cast the actionExecutingContext.ActionDescriptor to a ControllerActionDescriptor and use its ActionName propperty. If the action name is index, we just return the product root, but if it's product, we try to get the SKU from the route value id, and try to find the child node which matches the SKU and return that.

Now there's only one last thing to do, we need to register our shop controller, if you're creating a controller for your own site you can do it in the Configure method of Startup.cs like so:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    
    app.UseUmbraco()
        .WithMiddleware(u =>
        {
            u.WithBackOffice();
            u.WithWebsite();
        })
        .WithEndpoints(u =>
        {
            u.EndpointRouteBuilder.MapControllerRoute(
                "Shop Controller",
                "/shop/{action}/{id?}",
                new {Controller = "Shop", Action = "Index"});

            u.UseInstallerEndpoints();
            u.UseBackOfficeEndpoints();
            u.UseWebsiteEndpoints();
        });
}

As you can see there's nothing Umbraco specific abouth the controller routing, it's using the default MapController route of the EndpointRouteBuilder, we give our mapping a name, a pattern for the controller and some default values, so if no action is specified it will default to Index.

If you're creating a package you won't have access to the Startup.cs, so instead you can use a composer with an UmbracoPipelineFilter like so:

using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.DependencyInjection;
using Umbraco.Cms.Core.Composing;
using Umbraco.Cms.Core.DependencyInjection;
using Umbraco.Cms.Web.Common.ApplicationBuilder;

namespace RoutingDocs.Controllers
{
    public class ShopControllerComposer : IComposer
    {
        public void Compose(IUmbracoBuilder builder)
        {
            builder.Services.Configure<UmbracoPipelineOptions>(options =>
            {
                options.AddFilter(new UmbracoPipelineFilter(nameof(ShopController))
                {
                    Endpoints = app => app.UseEndpoints(endpoints =>
                    {
                        endpoints.MapControllerRoute(
                            "Shop Controller",
                            "/shop/{action}/{id?}",
                            new {Controller = "Shop", Action = "Index"});
                    })
                });
            });
        }
    }
}

With that we have our controller with a custom route within an Umbraco context.

Client-Side Requests

If the endpoint of your custom route is considered a client-side request e.g. /sitemap.xml, you will need to make a few changes to get this to work.

Define your route as before, specifying the correct client type route:

.WithEndpoints(u =>
{
    u.EndpointRouteBuilder.MapControllerRoute("Sitemap Xml", "/sitemap.xml",
        new { Controller = "SitemapXml", Action = "Index" });
});

You will need to configure your route request options within your Startup.cs class. For single routes:

services.Configure<UmbracoRequestOptions>(options =>
{
    options.HandleAsServerSideRequest = httpRequest => httpRequest.Path.StartsWithSegments("/sitemap.xml");
});

Or it can handle multiple routes:

services.Configure<UmbracoRequestOptions>(options =>
{
    string[] allowList = new[] {"/sitemap.xml", ...};
    options.HandleAsServerSideRequest = httpRequest =>
    {
        foreach (string route in allowList)
        {
            if (httpRequest.Path.StartsWithSegments(route))
            {
                return true;
            }
        }

        return false;
    };
});

In your FindContent method you should still be able to access and use IUmbracoContextAccessor through standard DI:

public IPublishedContent? FindContent(ActionExecutingContext actionExecutingContext)
{
    IUmbracoContext context = _umbracoContextAccessor.GetRequiredUmbracoContext();
    IPublishedContent? content = context.Content?.GetAtRoot().FirstOrDefault();

    return content;
}

Attribute routing with IVirtualPageController

One of the benefits of the IVirtualPageController is that it allows you to use attribute routing. If you wish to use attribute routing you must use an IVirtualPageController and decorate your controller and/or actions with the Route attribute. If we want to convert our above example into using attribute routing we must first add the attributes to our actions:

[Route("[controller]")]
[Route("[controller]/[action]")]
[HttpGet]
public IActionResult Index()

[Route("[controller]/[action]/{id?}")]
[HttpGet]
public IActionResult Product(string id)

Now all we need to do is change our routing to use EndpointRouteBuilder.MapControllers(); instead of adding a specific route.

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    
    app.UseUmbraco()
        .WithMiddleware(u =>
        {
            u.WithBackOffice();
            u.WithWebsite();
        })
        .WithEndpoints(u =>
        {
            u.EndpointRouteBuilder.MapControllers();

            u.UseInstallerEndpoints();
            u.UseBackOfficeEndpoints();
            u.UseWebsiteEndpoints();
        });
}

This will give us routing that's similar to what we have in the other example. It's worth noting that there's no defaults when using attribute routing, so to allow our index action to be accessed through both /shop and /shop/index, we add two attributes, specifying both routes individually.

Custom route with ForUmbracoPage

Making a custom route within the Umbraco context using ForUmbracoPage is quite similar to using IVirtualPageController. The main difference is that with ForUmbracoPage we no longer find the content from within the controller, instead we assign the FindContent method when routing the controller. One important thing about ForUmbracoPage is that attribute routing is not available, so to make our example from above work with ForUmbracoPage, we want to remove any attribute routing, and no longer implement IVirtualPageController, so we'll also remove the FindContent method, our controller will then end up looking like this:

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.ViewEngines;
using Microsoft.Extensions.Logging;
using RoutingDocs.Models;
using RoutingDocs.Persistence;
using Umbraco.Cms.Web.Common.Controllers;

namespace RoutingDocs.Controllers
{
    public class ShopController : UmbracoPageController
    {
        public ShopController(
            ILogger<UmbracoPageController> logger,
            ICompositeViewEngine compositeViewEngine)
            : base(logger, compositeViewEngine)
        { }

        [HttpGet]
        public IActionResult Index()
        {
            // CurrentPage (IPublishedContent) will be the content returned
            // from the FindContent method.

            // return the view with the IPublishedContent
            return View(CurrentPage);
        }

        [HttpGet]
        public IActionResult Product(string id)
        {
            // CurrentPage (IPublishedContent) will be the content returned
            // from the FindContent method.

            // One example of using a custom route would be to include additional
            // model information based on external services. For example, if
            // we wanted to return the stores the product is available in from
            // a custom data store.
            var dbProduct = DbContext.Products.GetBySku(id);
            var shopModel = new Product(CurrentPage)
            {
                Sku = id,
                AvailableStores = dbProduct.AvailableStores
            };

            return View(shopModel);
        }
    }
}

As you can see we still inherit from UmbracoPageController to get access to the helper method CurrentPage, but the rest is a normal controller.

The Umbraco magic will now instead happen where we route the controller, here we will pass a Func<ActionExecutingContext, IPublishedContent> delegate to the ForUmbracoPage method, this delegate is then responsible for finding the content, for instance using a composer with the same logic as in the IVirtualPageController it will look like this:

 public class ShopControllerComposer : IComposer
{
    public void Compose(IUmbracoBuilder builder)
    {
        builder.Services.Configure<UmbracoPipelineOptions>(options =>
        {
            options.AddFilter(new UmbracoPipelineFilter(nameof(ShopController))
            {
                Endpoints = app => app.UseEndpoints(endpoints =>
                {
                    endpoints.MapControllerRoute(
                        "Shop Controller",
                        "/shop/{action}/{id?}",
                        new {Controller = "Shop", Action = "Index"})
                        .ForUmbracoPage(FindContent); // Here we register our FindContent method
                })
            });
        });
    }

    private IPublishedContent FindContent(ActionExecutingContext actionExecutingContext)
    {
        // Resolve services from the container
        var umbracoContextAccessor = actionExecutingContext.HttpContext.RequestServices
            .GetRequiredService<IUmbracoContextAccessor>();
        var publishedValueFallback = actionExecutingContext.HttpContext.RequestServices
            .GetRequiredService<IPublishedValueFallback>();

        var umbracoContext = umbracoContextAccessor.GetRequiredUmbracoContext();
        var productRoot = umbracoContext.Content.GetById(2074);

        if (actionExecutingContext.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor)
        {
            // Check which action is executing
            switch (controllerActionDescriptor.ActionName)
            {
                case nameof(ShopController.Index):
                    return productRoot;
                
                case nameof(ShopController.Product):
                    // Get the SKU/Id from the route values
                    if (actionExecutingContext.ActionArguments.TryGetValue("id", out var sku))
                    {
                        return productRoot
                            .Children
                            .FirstOrDefault(c => c.Value<string>(publishedValueFallback, "sku") == sku.ToString());
                    }
                    else
                    {
                        return productRoot;
                    }
            }
        }
        return productRoot;
    }
}

The Compose method of our composer is much the same as any other normal routing, with one difference we call ForUmbracoPage on the MapControllerRoute where we pass in our FindContent method. The FindContent method is also largely the same as it was in the controller in the IVirtualPageController example, with one important difference. Since we can no longer inject our required service into the constructor, we instead request them using actionExecutingContext.HttpContext.RequestServices.GetRequiredService. It's important to note here that you should not save the HttpContext or the IServiceProvider you get from the actionExecutingContext to a field or property on the class since these will be specific for each request.

With this we have a custom routed controller within the Umbraco pipeline, if you navigate to /shop or /shop/product/<SKU> you will see the controllers actions being called with the content found in FindContent

Use a custom controller to handle and control incoming requests for content pages based on a specific Document Type

What is Umbraco Route Hijacking?

By default, all front end requests to an Umbraco site are auto-routed via the 'Index' action of a core Controller: Umbraco.Cms.Web.Common.Controllers.RenderController. This core controller handles the incoming request, builds the associated PublishedContent model, and passes this to the appropriate Umbraco Template/MVC View.

It is however possible to implement a custom Controller to replace this default implementation to give complete control over this execution.

For example:

• To enrich the view model passed to the template with additional properties (from other published content items or outside Umbraco)

• To implement serverside paging

• To implement any custom/granular security

• To return alternative templates depending on some custom business logic

This replacement of the default controller can be made 'globally' for all requests (see last example). It can also be by 'hijacking' requests for types of pages based on their specific Document Type following this controller naming convention: [DocumentTypeAlias]Controller.

Creating a custom controller

Example: Hijacking route requests to a 'product' page

In the following example, imagine an Umbraco site with a set of 'product' pages created from a Document Type called 'Product Page' with an alias 'productPage'.

Create a custom locally declared controller in the Umbraco web application project named 'ProductPageController'.

Ensure that this controller inherits from the base controller Umbraco.Cms.Web.Common.Controllers.RenderController.

eg:

All requests to any 'product' pages in the site will be'hijacked' and routed through the custom ProductPageController.

If you prefer to use an async controller your need to override both the sync and the async Index()-methods. This is done to disable the default behavior from the base controller.

This example shows the default behaviour that Umbraco's core RenderController provides. The 'Index' action of the controller is executed, and the CurrentTemplate helper sends the model containing the details of the published content item related to the request to the relevant template/view.

Routing via template

A further convention is that if an action on the controller has a name that matches the template name, this action will be executed instead of the default 'Index' action.

Example: Hijacking route requests to a 'product' for an alternative 'AMP' template

In this example, the Product Page Document Type has two templates 'ProductPage' and 'ProductAmpPage'. We can hijack and handle the requests to the two templates differently.

Create the Controller as before:

How can a page be requested via two different templates?

The page in Umbraco will have a single 'template' selected as it's default template, but it's possible to call this same page on a different template by adding ?altTemplate=othertemplatename to the Url QueryString eg:

/products/superfancyproduct/?altTemplate=ProductAmpPage

Summary - How the route hijacking convention works

• Document Type name = controller name

• Template name = action name (if no action matches or is not specified - then the 'Index' action will be executed).

• Controller Inherits from Umbraco.Cms.Web.Common.Controllers.RenderController

Returning a view with a custom model

The steps to achieve this will differ, depending if your template views are using IPublishedContent or Modelsbuilder generated Models.

Changing the @inherits directive of your template

By default, your Umbraco Template will be based on the ContentModel that the default RenderController passes through to it.

The default inherits statement:

or if you are using modelsbuilder:

<> contains a model generated for each document type to give strongly typed access to the Document Type properties in the template view.

To use a specific custom view model, the @inherits directive will need to be updated to reference your custom model using the Umbraco.Cms.Web.Common.Views.UmbracoViewPage<T> format where 'T' is the type of your custom model.

So for example, if your custom model is of type 'MyProductViewModel' then your @inherits directive will look like:

In most cases you will need your custom model to build upon the underlying existing PublishedContent model for the page. This can be achieved by making your custom model inherit from a special base class called PublishedContentWrapped:

PublishedContentWrapped will take care of populating all the usual underlying Umbraco properties and means the @Model. syntax will continue to work in the layouts used by your template.

Using Modelsbuilder you will find that all the generated models have a constructor that takes an IPublishedContent item in a similar way:

We can now populate our custom view model in our controller and use the values from the custom model in our template view:

and in our template

Processing QueryString values in the controller

You can also pass values directly into the controller action using the query string.

The values in the querystring will be bound to the matching parameters defined in the controller's action:

Controller Injection

For example:

To wire up a concrete instance of IMadeUpProductService, use a composer:

Replace Umbraco's default RenderController

You can replace Umbraco's default implementation of RenderController with your own custom controller for all MVC requests. This is possible by assigning your own default controller type in the Umbraco setup during initialization.

You can achieve this by updating the options for UmbracoRenderingDefaultsOptions in the ConfigureServices method in the Startup.cs class.

First of all you have to create your own controller. Your custom implementation of RenderController should either inherit from the core RenderController as in the examples above or implement the IRenderController interface.

Implement the IRenderController:

Or inherit from RenderController

The last step is to configure Umbraco to use your implementation. You can do that in the ConfigureServices method in the Startup.cs class.

This section describes what the Umbraco Request Pipeline is. It explains how Umbraco matches a document to a given request and how it generates a URL for a document.

Request pipeline

What is the pipeline

The request pipeline is the process of building up the URL for a node and resolving a request to a specified node. It ensures that the right content is sent back.

Outbound vs Inbound

Customizing the pipeline

In order for Umbraco to authenticate a request for the backoffice, the routing needs to be specific. Any URL that routes to:

/umbraco/backoffice/*

will be authenticated. If you have a controller that is not routed within the prefix, it will not be authenticated for backoffice use.

You do not have to worry about routing if you are using Umbraco.Cms.Web.BackOffice.Controllers.UmbracoAuthorizedApiController (or any inherited controller) since these are auto routed. All implementations of UmbracoAuthorizedApiController (which includes UmbracoAuthorizedJsonController) are auto-routed with the default route:

/umbraco/backoffice/api/{controller}/{action}

In the case that an Umbraco Api Controller is a 'Plugin Controller', then the route would be:

/umbraco/backoffice/{pluginname}/{controller}/{action}

MVC controllers for the backoffice

Depending on the type of controller used (MVC or WebAPI), the controller is not auto-routed. You will need to declare a custom route and register it with the Umbraco DI container to make it work.

For more information on authenticated/authorized controllers & attributes see the .

Defining a route

Defining a route is done with the standard .NET Core MVC routing practices, however there is a handy extension method on the IEndpointRouteBuilder to help you.

When creating custom routes you can either do it directly in the Startup.cs files, or with a pipeline filter in a composer which looks something like:

The signature of MapUmbracoRoute<T> is as follows

• The generic type argument is the contoller you wish to route, in this case MyController.

• rootSegment - The first part of the pattern, since this is an authorized controller it has to be umbraco/backoffice.

• areaName - The name of the area the controller should be routed through, an empty string signifies no area.

• prefixPathSegment - Prefix to be applied to the rootSegment, we know this from api controllers where the prefix is api, in this case since the controller is in an area we will also prefix the area name to the URL, so the final path pattern will be umbraco/backoffice/mypackagename/{controllerName}/{action}/{id?}.

• defaultAction - If this is not null or an empty string the request will automatically be routed to the specified action, so in this case umbraco/backoffice/mypackagename/{controllerName} will route to the index action.

• includeControllerNameInRoute - If this is false the controller name will be excluded from the route, so in this case the route would be umbraco/backoffice/mypackagename/{action}/{id?} if this was set to false.

Using the MapUmbracoRoute extension method is optional though, it's a neat helper to ensure controllers get routed in the same way. If your controller uses an area, like in this example, you need to specify this using the Area attribute. In this example the controller looks like this:

What about Surface Controllers?

Surface Controllers should not be used in the backoffice. Surface Controllers are not designed to work with the backoffice. They are not meant to be used there and will not be supported being used there.

With the release of Umbraco 9 and the change of the underlying web framework that is decoupled from the webserver, the way that you configure rewrites has changed as well.

Instead of the URL Rewriting extension in IIS you can use the , which needs to be added to your project startup code first.

When to use the URL Rewriting Middleware

Make sure to check the official documentation for more information about when you should or should not use the URL Rewriting Middleware.

Using the URL Rewriting Middleware

To use rewrites with Umbraco 9 you have to register the middleware in your Startup.cs by using the extension method and then configure the rewrite options.

Example

• Create an IISUrlRewrite.xml file in the root of your project (next to your Startup.cs file) containing:

• In your csproj file add the XML file to a new item group and set CopyToOutputDirectory to Always:

Rewrite rule shortcuts

RewriteOptions has a number of "shortcut" methods to implement commonly used rewrites including:

• AddRedirectToNonWww()

• AddRedirectToWww()

• AddRedirectToNonWwwPermanent()

• AddRedirectToWwwPermanent()

• AddRedirectToHttps()

Examples of rewrite rules

Another example would be to enforce HTTPS only on your site:

Another example would be to redirect from non-www to www (except for the Umbraco Cloud project hostname):

There are a few special/reserved Umbraco Property Type aliases that can be used which can manipulate how the standard Umbraco routing pipeline works. You can add these Property Types to any Document Type and if values are assigned to these properties, Umbraco will adjust its routing accordingly. See below for full details.

umbracoRedirect

Creating a property alias with this name and using a Content Picker property editor lets you create a 302 temporary redirect. This in effect means that when a user navigates to this node, they will be redirected away from it.

umbracoInternalRedirectId

Add this property alias to your Document Type with a Content Picker property editor and Umbraco will load the selected page’s content transparently without performing any URL redirection. This essentially performs a rewrite.

umbracoUrlName

This property when created as a text string lets you provide a different URL name to what is created by default by the name of the node. If you enter a value for this property and save/publish the content node you will see that its main URL is updated with a new path suffix.

umbracoUrlAlias

This property when created as a text string lets you provide a comma separated list of alternate full URL paths for the node. For example, if your URL was /some-category/some-page/content-node, by adding an umbracoUrlAlias of "flowers", a user can navigate to the node by going to /flowers. The URL alias remains in the browser address bar as a 'mask' over the real URL. You can also specify paths like "flowers/roses/red".

Filtering

All about Umbraco's routing pipeline & the types of Controllers used in Umbraco, how they work, and what they are used for.

Explains how Umbraco builds its URLs and how the URLs are mapped back to content items.

Describes the Umbraco special/reserved Property Type aliases that can be used to directly manipulate Umbraco's default routing pipeline. These special Property Type aliases can be useful when creating an Umbraco website.

What is a Surface Controller and how to use them?

What is an API Controller and how to use them?

Creating custom controllers to have 100% full control over how your pages are rendered. Also known as: Hijacking Umbraco Routes

How to specify your own custom MVC routes in your Umbraco application?

Routing requirements for authenticated controllers for both front-end and the backoffice.

Moving and renaming Umbraco documents will lead to URL redirects to be created.

The inbound process is triggered by UmbracoRouteValueTransformer and then handled with the Published router. The published content request preparation process kicks in and creates a PublishedRequestBuilder which will be used to create a PublishedContentRequest.

The PublishedContentRequest object represents the request which Umbraco must handle. It contains everything that will be needed to render it. All this occurs when the Umbraco modules knows that an incoming request maps to a document that can be rendered.

public class PublishedContentRequest
{
  public Uri Uri { get; }
  …
}

There are 3 important properties, which contains all the information to find a node:

public bool HasDomain { get; }
public DomainAndUri Domain { get; }
public CultureInfo Culture { get; }

Domain is a DomainAndUri object that is a standard Domain plus the fully qualified uri. For example, the Domain may contain "example.com" whereas the Uri will be fully qualified for example "https://example.com/".

It contains the content to render:

public bool HasPublishedContent { get; }
public IPublishedContent PublishedContent { get; set; }
public bool IsInternalRedirect { get; }
public bool IsRedirect {get; }

Contains template information:

public bool HasTemplate { get; }
public string GetTemplateAlias { get; }
public ITemplate Template {get; }

The published request is created using the PublishedRequestBuilder, which implements IPublishedRequestBuilder. It's only in this builder that it's possible to set values, such as domain, culture, published content, redirects, and so on.

You can subscribe to the 'routing request' notification, which is published right after the PublishedRequestBuilder has been prepared, but before the request is built, and processed. Here you can modify anything in the request before it is built and processed! For example content, template, etc:

using Umbraco.Cms.Core.Events;
using Umbraco.Cms.Core.Notifications;

namespace Umbraco9.NotificationHandlers
{
    public class PublishedRequestHandler : INotificationHandler<RoutingRequestNotification>
    {
        public void Handle(RoutingRequestNotification notification)
        {
            var requestBuilder = notification.RequestBuilder;
            // Do something with the IPublishedRequestBuilder here 
        }
    }
}

To create a custom content finder, with custom logic to find an Umbraco document based on a request, implement the IContentFinder interface:

public interface IContentFinder
{
  Task<bool> TryFindContent(IPublishedRequestBuilder contentRequest);
}

and use either an Umbraco builder extension, or a composer to add it to it to the ContentFindersCollection.

Umbraco runs all content finders in the collection 'in order', until one of the IContentFinders returns true. Once this occurs, the request is then handled by that finder, and no further IContentFinders are executed. Therefore the order in which ContentFinders are added to the ContentFinderCollection is important.

The ContentFinder can set the PublishedContent item for the request, or template or even execute a redirect.

Example

This IContentFinders will find a document with id 1234, when the Url begins with /woot.

public class MyContentFinder : IContentFinder
{
    private readonly IUmbracoContextAccessor _umbracoContextAccessor;

    public MyContentFinder(IUmbracoContextAccessor umbracoContextAccessor)
    {
        _umbracoContextAccessor = umbracoContextAccessor;
    }

    public Task<bool> TryFindContent(IPublishedRequestBuilder contentRequest)
    {
        var path = contentRequest.Uri.GetAbsolutePathDecoded();
        if (path.StartsWith("/woot") is false)
        {
            return Task.FromResult(false); // Not found
        }

        if (!_umbracoContextAccessor.TryGetUmbracoContext(out var umbracoContext))
        {
            return Task.FromResult(false);
        }

        // Have we got a node with ID 1234
        var content = umbracoContext.Content.GetById(1234);
        if (content is null)
        {
            // If not found, let another IContentFinder in the collection try.
            return Task.FromResult(false);
        }

        // If content is found, then render that node
        contentRequest.SetPublishedContent(content);
        return Task.FromResult(true);
    }
}

Adding and removing IContentFinders

You either use an extension on the Umbraco builder or, a composer to access the ContentFinderCollection to add and remove specific ContentFinders

Umbraco builder extension

First create the extension method:

using RoutingDocs.ContentFinders;
using Umbraco.Cms.Core.DependencyInjection;
using Umbraco.Cms.Core.Routing;

namespace RoutingDocs.Extensions
{
    public static class UmbracoBuilderExtensions
    {
        public static IUmbracoBuilder AddCustomContentFinders(this IUmbracoBuilder builder)
        {
            // Add our custom content finder just before the core ContentFinderByUrl
            builder.ContentFinders().InsertBefore<ContentFinderByUrl, MyContentFinder>();
            // You can also remove content finders, this is not required here though, since our finder runs before the url one
            builder.ContentFinders().Remove<ContentFinderByUrl>();
            // You use Append to add to the end of the collection
            builder.ContentFinders().Append<AnotherContentFinderExample>();
            // or Insert for a specific position in the collection
            builder.ContentFinders().Insert<AndAnotherContentFinder>(3);
            return builder;
        }
    }
}

Then invoke it in ConfigureServices in the Startup.cs file:

public void ConfigureServices(IServiceCollection services)
{
#pragma warning disable IDE0022 // Use expression body for methods
    services.AddUmbraco(_env, _config)
        .AddBackOffice()
        .AddWebsite()
        .AddComposers()
        .AddCustomContentFinders()
        .Build();
#pragma warning restore IDE0022 // Use expression body for methods
}

Composer

using Umbraco.Cms.Core.Composing;
using Umbraco.Cms.Core.DependencyInjection;
using Umbraco.Cms.Core.Routing;

namespace RoutingDocs.ContentFinders
{
    public class UpdateContentFindersComposer : IComposer
    {
        public void Compose(IUmbracoBuilder builder)
        {
            // Add our custom content finder just before the core ContentFinderByUrl
            builder.ContentFinders().InsertBefore<ContentFinderByUrl, MyContentFinder>();
            // You can also remove content finders, this is not required here though, since our finder runs before the url one
            builder.ContentFinders().Remove<ContentFinderByUrl>();
            // You use Append to add to the end of the collection
            builder.ContentFinders().Append<AnotherContentFinderExample>();
            // or Insert for a specific position in the collection
            builder.ContentFinders().Insert<AndAnotherContentFinder>(3);
        }
    }
}

NotFoundHandlers

To set your own 404 finder create an IContentLastChanceFinder and set it as the ContentLastChanceFinder. (perhaps you have a multilingual site and need to find the appropriate 404 page in the correct language)

A IContentLastChanceFinder will always return a 404 status code. This example creates a new implementation of the IContentLastChanceFinder and gets the 404 page for the current language of the request.

using System.Linq;
using System.Threading.Tasks;
using Umbraco.Cms.Core.Models.PublishedContent;
using Umbraco.Cms.Core.Routing;
using Umbraco.Cms.Core.Services;
using Umbraco.Cms.Core.Web;

namespace RoutingDocs.ContentFinders
{
    public class My404ContentFinder : IContentLastChanceFinder
    {
        private readonly IDomainService _domainService;
        private readonly IUmbracoContextAccessor _umbracoContextAccessor;

        public My404ContentFinder(IDomainService domainService, IUmbracoContextAccessor umbracoContextAccessor)
        {
            _domainService = domainService;
            _umbracoContextAccessor = umbracoContextAccessor;
        }
        
        public Task<bool> TryFindContent(IPublishedRequestBuilder contentRequest)
        {
            // Find the root node with a matching domain to the incoming request
            var allDomains = _domainService.GetAll(true).ToList();
            var domain = allDomains?
                .FirstOrDefault(f => f.DomainName == contentRequest.Uri.Authority
                                     || f.DomainName == $"https://{contentRequest.Uri.Authority}"
                                     || f.DomainName == $"http://{contentRequest.Uri.Authority}");

            var siteId = domain != null ? domain.RootContentId : allDomains.Any() ? allDomains.FirstOrDefault()?.RootContentId : null;

            if (!_umbracoContextAccessor.TryGetUmbracoContext(out var umbracoContext))
            {
                return Task.FromResult(false);
            }

            if (umbracoContext.Content == null)
                return new Task<bool>(() => contentRequest.PublishedContent is not null);

            var siteRoot = umbracoContext.Content.GetById(false, siteId ?? -1);

            if (siteRoot is null)
            {
                return Task.FromResult(false);
            }

            // Assuming the 404 page is in the root of the language site with alias fourOhFourPageAlias
            var notFoundNode = siteRoot.Children?.FirstOrDefault(f => f.ContentType.Alias == "fourOhFourPageAlias");

            if (notFoundNode is not null)
            {
                contentRequest.SetPublishedContent(notFoundNode);
            }

            // Return true or false depending on whether our custom 404 page was found
            return Task.FromResult(contentRequest.PublishedContent is not null);
        }
    }
}

You can configure Umbraco to use your own implementation in the ConfigureServices method of the Startup class in Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    services.AddUmbraco(_env, _config)
        .AddBackOffice()
        .AddWebsite()
        .AddComposers()
        // If you need to add something Umbraco specific, do it in the "AddUmbraco" builder chain, using the IUmbracoBuilder extension methods.
        .SetContentLastChanceFinder<RoutingDocs.ContentFinders.My404ContentFinder>()
        .Build();
}

Is started in UmbracoRouteValueTransformer where it gets the HttpContext and RouteValueDictionary from the netcore framework:

 async ValueTask<RouteValueDictionary> TransformAsync(…)

What it does:

• It ensures Umbraco is ready, and the request is a document request.

• Ensures there's content in the published cache, if there isn't it routes to the RenderNoContentController which displays the no content page you see when running a fresh install.

• Creates a published request builder.

• Routes the request with the request builder using the PublishedRouter.RouteRequestAsync(…).

  • This will handle redirects, find domain, template, published content and so on.

  • Build the final IPublishedRequest.

• Sets the routed request in the Umbraco context, so it will be available to the controller.

• Create the route values with the UmbracoRouteValuesFactory.

  • This is what actually routes your request to the correct controller and action, and allows you to hijack routes.

• Set the route values to the http context.

• Handles posted form data.

• Returns the route values to netcore so it routes your request correctly.

RouteRequestAsync

When the RouteRequestAsync method is invoked on the PublishedRouter it will:

• FindDomain().

• Handle redirects.

• Set culture.

• Find the published content.

  • Only if it doesn't exist, allowing you to handle it in a custom way with a custom router handler.

• Find the template.

• Set the culture (again, in case it was changed).

• Publish RoutingRequestNotification.

• Handle redirects and missing content.

• Initialize a few internal stuff.

We will discuss a few of these steps below.

FindDomain()

The FindDomain method looks for a domain matching the request Uri

• Using a greedy match: “domain.com/foo” takes over “domain.com”.

• Sets published content request’s domain.

• If a domain was found.

  • Sets published content request’s culture accordingly.

  • Computes domain Uri based upon the current request ("domain.com" for "http://domain.com" or "https://domain.com").

• Else.

  • Sets published content request’s culture by default (first language, else system).

Find published content

When finding published content the PublishedRouter will first check if the PublishedRequestBuilder already has content, if it doesn't the content finders will kick in. There a many different types of content finders, such as find by url, by id path, and more. If none of the content finders manages to find any content, the request will be set as 404, and the ContentLastChanceFinder will run, this will try to find a page to handle a 404, if it can't find one, the ugly 404 will be used.

You can also implement your own content finders and last chance finder, for more information, see IContentFinder

The PublishedRouter will also follow any internal redirects there might be, it is however limited, as to not spiral out of control if there is an infite loop of redirects.

Find template

Once the content has been found, the PublishedRouter moves on to finding the template.

First off it checks if any content was found, if it wasn't it sets the template to null, since there can't be a template without content.

Next it checks to see if there is an alternative template which should be used. An alternative template will be used if the router can find a value with the key "altTemplate", in either the querystring, form, or cookie, and there is content found by the contentfinders, so not the 404 page, or it's an internal redirect and the web routing setting has InternalRedirectPreservesTemplate.

If no alternative template is found the router will get the template with the file service, using the ID specified on the published content, and then assign the template to the request.

If an alternative template is specified, the router will check if it's an allowed template for the content, if the template is not allowed on that specific piece of content it will revert to using the default template. If the template is allowed it will then use the file service to get the specified alternative template and assign the template to the request.

Redirects

The router will pick up the redirect and redirect. There is no need to write your own redirects:

PublishedContentRequest.Prepared += (sender, args) =>
{
public void Handle(RoutingRequestNotification notification)
{
    var requestBuilder = notification.RequestBuilder;
    var content = requestBuilder.PublishedContent;
    var redirect = content.Value<string>("myRedirect");
    if (!string.IsNullOrWhiteSpace(redirect))
    {
        requestBuilder.SetRedirect(redirect);
    }
}
}

Missing template?

In case the router can't find a template, it will try and verify if there's route hijacking in place, if there is, it will run the hijacked route. If route hijacking is not in place, the router will set the content to null, and run through the routing of the request again, in order for the last chance finder to find a 404.

A surface controller is an MVC controller that interacts with the front-end rendering of an Umbraco page. They can be used for rendering view components and for handling form data submissions. Surface controllers are auto-routed, meaning that you don't have to add/create your own routes for these controllers to work.

What is a surface controller?

It is a regular ASP.NET Core MVC controller that:

• Is auto-routed, meaning you don't have to setup any custom routes to make it work

• Is used for interacting with the front-end of Umbraco (not the backoffice)

Since any surface controller inherits from the Umbraco.Cms.Web.Website.Controllers.SurfaceController class, the controller instantly supports many of the helper methods and properties that are available on the base SurfaceController class including UmbracoContext. Therefore, all surface controllers have native Umbraco support for:

• Interacting with Umbraco routes during HTTP POSTs (i.e. return CurrentUmbracoPage(); )

• Rendering forms in Umbraco (i.e. @using (Html.BeginUmbracoForm<MyController>(...)){} )

• Rendering of ASP.NET Core MVC view components

Creating a surface controller

Surface controllers are plugins, meaning they are found when the Umbraco application boots. There are 2 types of surface controllers: locally declared & plugin based. The main difference between the two is that a plugin based controller gets routed via an MVC area, which is defined in the controller (see below). Because a plugin based controller is routed via an MVC area, it means that the views can be stored in a custom folder specific to the package it is being shipped in. This can be done without interfering with the local developer's MVC view files.

Locally declared controllers

A locally declared surface controller is one that is not shipped within an Umbraco package. It is created by the developer of the website they are creating. If you are planning on shipping a surface controller in an Umbraco package, then you will need to create a plugin based surface controller (see the next heading).

To create a locally declared surface controller:

• Create a controller that inherits from Umbraco.Cms.Web.Website.Controllers.SurfaceController

• The controller must be a public class.

• The controller must call the base constructor of SurfaceController

• The controller's name must be suffixed with the term Controller

• The controller must be inside a namespace

For example:

using Microsoft.AspNetCore.Mvc;
using Umbraco.Cms.Core.Cache;
using Umbraco.Cms.Core.Logging;
using Umbraco.Cms.Core.Routing;
using Umbraco.Cms.Core.Services;
using Umbraco.Cms.Core.Web;
using Umbraco.Cms.Infrastructure.Persistence;
using Umbraco.Cms.Web.Website.Controllers;

namespace RoutingDocs.Controllers
{
    public class MyController : SurfaceController
    {
        public MyController(
            IUmbracoContextAccessor umbracoContextAccessor,
            IUmbracoDatabaseFactory databaseFactory,
            ServiceContext services,
            AppCaches appCaches,
            IProfilingLogger profilingLogger,
            IPublishedUrlProvider publishedUrlProvider)
            : base(umbracoContextAccessor, databaseFactory, services, appCaches, profilingLogger, publishedUrlProvider)
        {
        }

        public IActionResult Index()
        {
            return Content("Hello world");
        }
    }
}

Routing for locally declared controllers

All locally declared controllers gets routed to:

/umbraco/surface/{controllername}/{action}/{id}

They do not get routed via an MVC area, so any views must exist in the following folders:

• /Views/{controllername}/

• /Views/Shared/

• /Views/

Plugin based controllers

If you are shipping a surface controller in a package, then you should definitely be creating a plugin based surface controller. The only difference between creating a plugin based controller and locally declared controller, is that you need to add an attribute to your class, which defines the MVC area you'd like your controller to be routed through. Here's an example:

using Microsoft.AspNetCore.Mvc;
using Umbraco.Cms.Core.Cache;
using Umbraco.Cms.Core.Logging;
using Umbraco.Cms.Core.Routing;
using Umbraco.Cms.Core.Services;
using Umbraco.Cms.Core.Web;
using Umbraco.Cms.Infrastructure.Persistence;
using Umbraco.Cms.Web.Common.Attributes;
using Umbraco.Cms.Web.Website.Controllers;

namespace SurfaceControllerPackage
{
    [PluginController("SurfaceControllerPackage")]
    public class MyController : SurfaceController
    {
        public MyController(
            IUmbracoContextAccessor umbracoContextAccessor,
            IUmbracoDatabaseFactory databaseFactory,
            ServiceContext services,
            AppCaches appCaches,
            IProfilingLogger profilingLogger,
            IPublishedUrlProvider publishedUrlProvider)
            : base(umbracoContextAccessor, databaseFactory, services, appCaches, profilingLogger, publishedUrlProvider)
        {
        }

        public IActionResult Index()
        {
            return Content("Hello world");
        }
    }
}

In the above, the surface controller will belong to the MVC area called 'SurfaceControllerPackage'. Perhaps it is obvious, but if you are creating a package that contains many surface controllers, then you should most definitely ensure that all of your controllers are routed through the same MVC area.

Routing for plugin based controllers

All plugin based controllers get routed to:

/umbraco/{areaname}/{controllername}/{action}/{id}

Since they get routed via an MVC area, your views should be placed in the following folder:

• ~/App_Plugins/{areaname}/Views/{controllername}/

• ~/App_Plugins/{areaname}/Views/Shared/

Since you're only able to place static filese within your package's App_Plugin folder, it's highly recommend to ensure that the area you use is the same as your package name, since that allows your views to be found.

The controller itself should not be placed in the App_Plugins folder, the App_Plugins folder is for static files only, compiled files like the controller will be included in the dlls used by the nuget package.

Protecting surface controller routes

If you only want a surface controller action to be available when it's used within an Umbraco form and not from the auto-routed URL, you can add the [ValidateUmbracoFormRouteString] attribute to the action method. This can be especially useful for plugin based controllers, as this makes sure the actions can only be activated from a form whenever it's used within the website.

namespace RoutingDocs.Controllers
{
    public class MyController : SurfaceController
    {
        public MyController(
            IUmbracoContextAccessor umbracoContextAccessor,
            IUmbracoDatabaseFactory databaseFactory,
            ServiceContext services,
            AppCaches appCaches,
            IProfilingLogger profilingLogger,
            IPublishedUrlProvider publishedUrlProvider)
            : base(umbracoContextAccessor, databaseFactory, services, appCaches, profilingLogger, publishedUrlProvider)
        {
        }

        [HttpPost]
        [ValidateUmbracoFormRouteString]
        public IActionResult HandleSubmit()
        {
            return RedirectToCurrentUmbracoPage();
        }
    }
}

Whenever you render an Umbraco form within your view using Html.BeginUmbracoForm<MyController>(...), the forms action will be the URL of the current page (not the auto-routed URL of the surface controller). Umbraco will therefore add a hidden ufprt field to the form with an encrypted value containing the controller, action and optional area (known as the 'Umbraco form route string'). On form submission, this value is decrypted and Umbraco will activate the specified action of the surface controller.

@using (Html.BeginUmbracoForm<MyController>("HandleSubmit"))
{
    <input type="submit" />
}

Preventing Cross-Site Request Forgery (XSRF/CSRF) Attacks

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated.

If the token is not added automatically, for instance, if you don't use Html.BeginUmbracoForm or use an overload to Html.BeginForm where you've set the antiForgery parameter to false, you can add it manually like so:

@using (Html.BeginForm(nameof(ContactFormController.Submit), "ContactForm", new object(), FormMethod.Post, false /* this is where you disable it */, new object()))
{
  @Html.AntiForgeryToken()
  // Add your form fields here
}

If you are using a SurfaceController the antiforgery token will automatically be validated. However, if you are using a standard (non-umbraco) controller, you can manually specify it with the ValidateAntiForgeryToken attribute:

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult EditAction(FormViewModel formData)
{
    // Handle your form submit here
}