Skip to main content
Optimizely Academy

End-user eLearning

Upcoming events

Certification

Partner training

Community

All Topics

Modern development practices for CMS 12

  • By Optimizely Education
  • Published: Mar 3, 2026
  • Rating
    Average rating: 0 No reviews

Outline
At a glance:
  • Core shift: CMS 12 embraces ASP.NET Core patterns like Dependency Injection and middleware pipelines.
  • Architecture focus: Modular design, async programming, and API-first development are now standard.
  • Quality mindset: Automated testing, structured logging, and monitoring are essential.
  • Security first: HTTPS, Identity, input validation, and CSP are non-negotiable best practices.

This module explores the modern development practices essential for building robust, scalable, and maintainable solutions on Optimizely CMS 12. With the platform's foundation on ASP.NET Core, developers must adopt contemporary .NET methodologies that emphasize performance, testability, and cloud-native principles.

Embracing Core ASP.NET Core Patterns

1. Dependency Injection (DI) Everywhere

  • Principle: Register services in Program.cs and inject them via constructors.
  • Benefit: Promotes loose coupling and testability.
  • Optimizely Context: Services like IContentLoader and IContentRepository follow DI patterns.
C#
// In Program.cs builder.Services.AddTransient<IMyCustomService, MyCustomService>(); // In a controller public class MyController : Controller { private readonly IMyCustomService _service; public MyController(IMyCustomService service) { _service = service; } }

2. Middleware Pipeline

  • Principle: HTTP requests pass through a configurable middleware pipeline.
  • Benefit: Clean handling of cross-cutting concerns like authentication and logging.
C#
// In Program.cs app.UseMiddleware<MyCustomLoggingMiddleware>(); app.UseRouting(); app.UseAuthentication(); app.UseAuthorization(); app.UseEndpoints(endpoints => endpoints.MapContent());

Note: Middleware order matters. Authentication must come before authorization, and MapContent() must come after routing is configured. Incorrect ordering is one of the most common sources of auth failures in CMS 12 migrations.

Architectural Patterns and Design Principles

Key patterns

Select a pattern to expand and read the details.

Asynchronous Programming (async/await) ▼
  • Principle: Use async and await for all I/O-bound operations including database queries, external API calls, and file access.
  • Benefit: Frees up thread-pool threads during waiting, improving throughput and responsiveness under load.
Modular Design and Separation of Concerns ▼
  • View Components: Encapsulate reusable UI logic away from page controllers.
  • Separate Projects: Organize the solution into Core, Features, Web, and Tests.
  • Service Layers: Keep controllers thin by moving business logic to services.
API-First Development ▼
  • Principle: Design APIs as the primary contract before building UI or integrations.
  • Benefit: Supports headless CMS delivery, mobile apps, and third-party integrations without rework.

Quality Assurance and Performance Optimization

Testability and Automated Testing

  • Unit Testing: Test business logic in isolation using xUnit or NUnit.
  • Integration Testing: Use WebApplicationFactory to validate the full request pipeline.
  • Mocking: Use Moq or NSubstitute to isolate dependencies in unit tests.

Performance Optimization

  • Caching: Use IMemoryCache for single-node or IDistributedCache for multi-node DXP environments.
  • Efficient Queries: Avoid N+1 query patterns and use async calls throughout.
  • Profiling: Monitor using Application Insights or equivalent APM tooling.

Logging and Monitoring

  • Structured Logging: Use Microsoft.Extensions.Logging or Serilog with structured output for queryable log streams.
  • Centralized Monitoring: Integrate APM tools to correlate logs, traces, and metrics across services.

Security Best Practices

  • Input Validation: Validate all user input at the model and service layer.
  • Authentication and Authorization: Use ASP.NET Core Identity with policy-based authorization.
  • HTTPS Everywhere: Enforce secure transport and redirect HTTP to HTTPS in middleware.
  • CSRF Protection: Use Anti-Forgery tokens on all state-changing form submissions.
  • Content Security Policy: Define a CSP header to reduce XSS attack surface.

Pro tip: In Optimizely DXP environments, enforce HTTPS at the infrastructure level as well as in middleware. A missing app.UseHsts() call combined with a misconfigured load balancer is a common security gap after migration.

Conclusion

By embracing Dependency Injection, modular architecture, async programming, testing, performance optimization, and strong security practices, development teams can build scalable and future-proof Optimizely CMS 12 solutions.