ASP.NET MVC (Razor)

This section documents ASP.NET MVC 5.3.x, ASP.NET Web API 2.2, ASP.NET Web Pages 3, OWIN/Katana, SignalR 2, and ASP.NET Identity 2 — all running on .NET Framework 4.8.1 — the System.Web-hosted MVC framework, its routing, Razor views, HTML helpers, model binding, filters, and the OWIN-based authentication/Identity stack — as described by the official documentation at Microsoft Learn (plus Web API, Web Pages, SignalR, and Identity), which are the reference these pages are written and verified against.

This is not ASP.NET Core MVC. ASP.NET MVC 5 is the pre-Core, System.Web-hosted MVC framework; it is functionally frozen and receives only security fixes. For the current, cross-platform MVC framework see MVC Controllers and Views under ASP.NET Core (Blazor).

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

This section’s bibliography lists the reference material consulted while preparing these pages.

This section documents ASP.NET MVC 5.3.x and the technologies that shipped alongside it on .NET Framework 4.8.1: ASP.NET Web API 2.2, ASP.NET Web Pages 3, the OWIN/Katana middleware pipeline, SignalR 2, and ASP.NET Identity 2. Together these form the System.Web-hosted "MVC 5" generation of ASP.NET — the framework that replaced the Web Forms .aspx page model with Razor views, convention-based controllers, and an extensible, testable request pipeline, while still running inside IIS on top of System.Web.

Scope: MVC 5, not ASP.NET Core MVC

ASP.NET MVC 5 and ASP.NET Core MVC are two different frameworks that happen to share a name and a set of ideas. MVC 5:

Targets .NET Framework only (this section targets 4.8.1, the final Framework release) and hosts inside System.Web/IIS via System.Web.Routing and the ASP.NET pipeline (HttpModule/HttpHandler).
Ships as NuGet packages (Microsoft.AspNet.Mvc, Microsoft.AspNet.WebApi, Microsoft.AspNet.WebPages) added to a Framework project, not as part of a cross-platform SDK.
Uses HttpContextBase, ActionResult, HTML helpers (Html.TextBoxFor, …), web.config, and a separate Web API pipeline (ApiController, HttpConfiguration) that is architecturally distinct from MVC’s own Controller pipeline.
Is functionally frozen: Microsoft ships security fixes only, and no new MVC 5 features have shipped since the mid-2010s.

ASP.NET Core MVC (covered under ASP.NET Core (Blazor)) is a ground-up rewrite: cross-platform, IActionResult/Tag Helpers instead of ActionResult/HTML helpers, a single unified pipeline for MVC and Web API, built-in dependency injection, and active development. The two frameworks share vocabulary (controller, action, view, model binding) but almost no API surface — code does not port by find-and-replace. See Migrating to ASP.NET Core for the concrete mapping.

If you are starting a new project, none of this section applies to you — go straight to Getting Started with ASP.NET Core. This section exists for teams maintaining or extending an existing MVC 5 / Web API 2 codebase.

Support status

NET Framework 4.8.1 is in extended support: Microsoft continues to ship it with Windows and patches security

issues, but no new .NET Framework version will ever ship, and MVC 5, Web API 2, Web Pages 3, SignalR 2, and Identity 2 are all in maintenance-only mode. See the .NET Framework support lifecycle and Choosing an ASP.NET Framework for guidance on when to migrate an existing MVC 5 application versus leaving it in place.

What’s covered

Getting started and fundamentals

Getting Started — the MVC 5 project template, Global.asax, App_Start configuration classes, the core NuGet packages, and folder conventions.
The MVC Pattern and Request Life Cycle — how a request travels from UrlRoutingModule to a rendered view, and MVC vs. Web Forms.
Controllers and Actions — Controller, action selectors, the ActionResult family, ViewBag/ViewData/TempData, and async actions.
Routing and Areas — convention and attribute routing, route constraints, UrlHelper, and areas.

Views

Razor Syntax — the Razor view engine, @ expressions, directives, and ASP.NET Web Pages 3.
Views, Layouts, and Partials — layouts, sections, partial views, and display/editor templates.
HTML Helpers and Forms — strongly typed helpers, form building, and validation markup.

Data flow

Model Binding and Validation — binding sources, over-posting, DataAnnotations, and ModelState.
Filters — authorization, action, result, and exception filters.

Client-side and other frameworks of the era

Bundling and Client-Side Integration — System.Web.Optimization, the Bootstrap/jQuery baseline, and SPA templates.
ASP.NET Web API 2 — ApiController, IHttpActionResult, content negotiation, OData, and hosting.
SignalR 2 — hubs, transports, groups, and scale-out.

Security and identity

Authentication, Identity, and OWIN — the OWIN/Katana pipeline and ASP.NET Identity 2.
Security Hardening — CSRF, XSS, open redirect, and the OWASP Top 10 mapped onto MVC 5.

Data, performance, and operations

Data Access with EF6 — DbContext, migrations, and async queries.
Caching and Performance — output caching, donut caching, and thread-pool starvation.
Testing and Diagnostics — unit testing controllers, OWIN TestServer, and ELMAH.

Moving forward

Migrating to ASP.NET Core — a concrete MVC 5 → ASP.NET Core mapping table and incremental migration strategy.