Your ASP.NET Core Endpoints Don't Have a Timeout

This article explains that ASP.NET Core doesn't apply request timeouts by default and introduces the built-in request timeout middleware available in .NET 8. It demonstrates how to register the middleware and apply a per-endpoint timeout using the WithRequestTimeout extension method. The key concept is cooperative cancellation: the middleware cancels HttpContext.RequestAborted, but your code must pass that token to downstream operations like database calls or Task.Delay to actually stop work. The article includes code examples for minimal APIs, explains the default 504 response, and warns that timeouts don't trigger when a debugger is attached. It also emphasizes passing the cancellation token through service layers to EF Core for effective cancellation.