ASP.NET Core Razor 8.0

Apply the ASP.NET Core 8.0 prompt first. Use these rules for .cshtml Razor Pages and MVC views targeting net8.0 on ASP.NET Core 8.0. Blazor .razor components require their own guidance. Keep .NET 8 and Microsoft.AspNetCore.App current and migrate before support ends on November 10, 2026.

Template and page trust

• Treat .cshtml files, _ViewImports.cshtml, _ViewStart.cshtml, Tag Helpers, View Components, and Razor class libraries as executable application code. Accept them only from reviewed source and immutable deployment artifacts; never render user- or tenant-authored Razor.
• Keep page, view, partial, layout, and component names server-selected. If the application offers a finite theme or presentation choice, map the untrusted value through an explicit allowlist instead of using it as a name, path, or RazorViewEngineOptions.ViewLocationFormats entry.
• In IViewLocationExpander.PopulateValues, add bounded, validated tenant, theme, or culture identifiers to context.Values whenever those values change view discovery. The view lookup cache includes these values; computing a different path only in ExpandViewLocations can reuse another tenant's cached lookup.
• Keep custom view locations and runtime-compilation FileProvider roots confined to read-only, application-owned directories. Never point Razor at an upload, content-management, tenant, temporary, or otherwise attacker-writable directory.
• Inventory pages, controllers, page models, views, and View Components contributed by every Razor class library. Remember that a host application's matching