Hosting Models: Kestrel, IIS & Reverse Proxies

// Program.cs -- Kestrel is used automatically via WebApplication.CreateBuilder
var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
app.MapGet("/", () => "Hello from Kestrel");
app.Run();

// Kestrel listens directly on the configured port, e.g. http://localhost:5000

Common follow-ups: When would you run Kestrel directly without any reverse proxy in front of it?;What capabilities does IIS or a reverse proxy add that Kestrel alone doesn't provide?

<!-- web.config -->
<aspNetCore processPath="dotnet" arguments=".\MyApp.dll"
            hostingModel="inprocess" />  <!-- default, better performance -->

<!-- Alternative: out-of-process -->
<aspNetCore processPath="dotnet" arguments=".\MyApp.dll"
            hostingModel="outofprocess" />

Common follow-ups: What are the specific scenarios where out-of-process hosting would still be preferred despite the performance cost?;How do app pool recycling behaviors differ between the two models?

builder.WebHost.ConfigureKestrel(options => {
    options.Limits.MaxRequestBodySize = 30_000_000;
    options.Limits.MinRequestBodyDataRate = new MinDataRate(bytesPerSecond: 100, gracePeriod: TimeSpan.FromSeconds(10));
    options.Limits.KeepAliveTimeout = TimeSpan.FromMinutes(2);
    options.Limits.RequestHeadersTimeout = TimeSpan.FromSeconds(30);
});

Common follow-ups: What specific protections does a CDN or cloud load balancer provide that Kestrel's own configuration can't fully replace?;How do you decide whether standalone Kestrel is sufficient versus needing a dedicated reverse proxy?

builder.Services.Configure<ForwardedHeadersOptions>(options => {
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    options.KnownProxies.Add(IPAddress.Parse("10.0.0.5"));  // trust only this specific proxy
});

var app = builder.Build();
app.UseForwardedHeaders();  // must run early in the pipeline, before other middleware relying on client IP/scheme

Common follow-ups: What security risk exists if you trust X-Forwarded-For headers from untrusted or unconfigured sources?;Why must UseForwardedHeaders() run before other middleware that depend on the client IP or scheme?

// Program.cs -- YARP as a reverse proxy defined entirely in C#/appsettings
builder.Services.AddReverseProxy()
    .LoadFromConfig(builder.Configuration.GetSection("ReverseProxy"));

var app = builder.Build();
app.MapReverseProxy();

// appsettings.json
"ReverseProxy": {
  "Routes": { "route1": { "ClusterId": "cluster1", "Match": { "Path": "/api/{**catch-all}" } } },
  "Clusters": { "cluster1": { "Destinations": { "d1": { "Address": "https://backend:5001" } } } }
}

Common follow-ups: What are YARP's current limitations compared to a mature, battle-tested option like nginx for extreme-scale scenarios?;How does YARP's load balancing and health-checking compare to nginx's built-in capabilities?

// appsettings.json
"Kestrel": {
  "Endpoints": {
    "Http": { "Url": "http://*:5000" },
    "Https": { "Url": "https://*:5001", "Certificate": { "Path": "cert.pfx", "Password": "..." } }
  }
}

// Or in code
builder.WebHost.ConfigureKestrel(options => {
    options.ListenAnyIP(5000);
    options.ListenAnyIP(5001, o => o.UseHttps("cert.pfx", "password"));
});

Common follow-ups: How do you configure a separate management/admin endpoint that's only accessible internally?;What's the interaction between Kestrel endpoint configuration and a reverse proxy handling the actual public-facing HTTPS termination?

<!-- web.config -- enable stdout logging to diagnose startup failures -->
<aspNetCore processPath="dotnet" arguments=".\MyApp.dll"
            stdoutLogEnabled="true"
            stdoutLogFile=".\logs\stdout" />

# Check Windows Event Viewer's Application log for ASP.NET Core Module errors
# Check IIS's own HTTP error logs for the specific 502.x sub-status code, which narrows the cause

Common follow-ups: What do the different IIS 502.x sub-status codes indicate about the specific failure type?;How does this diagnostic approach differ when the reverse proxy is nginx instead of IIS?

<!-- web.config -- installed automatically by the .NET hosting bundle, referenced here -->
<system.webServer>
  <handlers>
    <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
  </handlers>
  <aspNetCore processPath="dotnet" arguments=".\MyApp.dll" hostingModel="inprocess" />
</system.webServer>

Common follow-ups: What needs to be installed on a Windows Server for the ASP.NET Core Module to function (the hosting bundle)?;How does ANCM's process restart behavior interact with graceful shutdown of in-flight requests?

builder.WebHost.ConfigureKestrel(options => {
    options.Limits.MaxConcurrentConnections = 1000;
    options.Limits.MaxConcurrentUpgradedConnections = 1000;  // e.g., WebSocket connections
});

// In Program.cs, before the host builds
ThreadPool.SetMinThreads(workerThreads: 200, completionPortThreads: 200);

Common follow-ups: What are the risks of setting MaxConcurrentConnections too low versus too high?;How do you determine the right MinThreads value through load testing rather than guessing?

# Dockerfile
FROM mcr.microsoft.com/dotnet/aspnet:8.0
ENV ASPNETCORE_URLS=http://+:8080
COPY . /app
WORKDIR /app
ENTRYPOINT ["dotnet", "MyApp.dll"]

# Kubernetes Service/Ingress handles TLS termination and load balancing externally,
# container itself just exposes plain HTTP on 8080 internally

Common follow-ups: What are the security implications of running plain HTTP inside the cluster network versus end-to-end encryption?;How does a service mesh sidecar proxy change this picture further?