---
title: BolMiddleware overview
summary: High-level purpose, scope, and responsibilities for BolMiddleware.
status: draft
owner: SAIF IT Core Services
last_reviewed: 2026-10-12
library: BolMiddleware
reference_type: package
---

# BolMiddleware overview

> **Documentation context:** Pipeline-packed library, NuGet package

BolMiddleware is a net8.0 ASP.NET Core Razor class library that supplies the Business Online (BOL) page chrome and context handling to SAIF Razor Pages applications. It sits between the consuming application and the remote BOL Context, BOL Menu, Policy Header, and Policy Core APIs, and it has no database access of its own.

## Purpose
- Give consumer applications a shared BOL look and behavior: layouts, menu, policy header, and page header.
- Carry the user's BOL web context (application, policy, claim) across applications through a short-lived cookie, the session, and the BOL Context API.
- Consumed by BOL Razor Pages applications that inherit `BolRazorLayoutStartup` and derive their pages from `BolContextModel`, `BolMenuModel`, or `BolPolicyModel`.

## Responsibilities
- Register BOL services and API clients ([Service registration](service-registration.md)).
- Resolve and persist the web context for each request ([BR-BOLMIDDLEWARE-001](business-rules.md#br-bolmiddleware-001-web-context-resolution-precedence), [BR-BOLMIDDLEWARE-002](business-rules.md#br-bolmiddleware-002-context-save-condition)).
- Load the BOL menu and apply context changes ([BR-BOLMIDDLEWARE-007](business-rules.md#br-bolmiddleware-007-menu-source-selection), [BR-BOLMIDDLEWARE-008](business-rules.md#br-bolmiddleware-008-context-value-classification)).
- Load the policy header, check policy access, and offer the policy dropdown ([BR-BOLMIDDLEWARE-009](business-rules.md#br-bolmiddleware-009-policy-access-validation), [BR-BOLMIDDLEWARE-012](business-rules.md#br-bolmiddleware-012-policy-dropdown-visibility)).
- Provide four layouts, partial views, three view components, and a navigation script.

## Key components
- `BolRazorLayoutStartup`: startup base class that enables legacy BOL authentication and binds `BasicAppMap`.
- `BolContextModel`, `BolMenuModel`, `BolPolicyModel`: chained abstract page models for context, menu, and policy header behavior.
- `WebContextService`, `MenuService`, `PolicyHeaderService`, `SecurityService`: facades over the remote API clients.
- `BolPolicyHeaderViewComponent`, `BolSideMenuViewComponent`, `BolTopMenuViewComponent`: page chrome view components.
- `_PolicyLayout`, `_PolicyOnlyLayout`, `_ContextOnlyLayout`, `_MenuOnlyLayout`: shared Razor layouts.
- `MenuNavigation.js`: browser script for menu navigation.

## Behavior and notable findings
The library enforces 21 business rules ([Business rules](business-rules.md)) across 17 catalogued operations ([Operations and processes](operations-processes.md)). Notable findings are the disabled anti-forgery validation on derived pages, cookies without Secure and SameSite attributes, a fully commented-out `BolLayoutStartup`, and a duplicate `IBolContextApiClient` registration; see [Security and authorization](security-authorization.md).

## Related documentation
- [Index](index.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Service registration](service-registration.md)
- [API reference](api/index.md)

## Sources
- src/BolMiddleware/BolMiddleware.csproj
- src/BolMiddleware/BolRazorLayoutStartup.cs
- src/BolMiddleware/BolLayoutStartup.cs
- src/BolMiddleware/Extensions/BolMiddlewareExtensions.cs
- src/BolMiddleware/Models/BolContextModel.cs
- src/BolMiddleware/Models/BolMenuModel.cs
- src/BolMiddleware/Models/BolPolicyModel.cs
- src/BolMiddleware/wwwroot/js/MenuNavigation.js