Which web server are you using in production for ASP.NET Core on a *nix server?

Question

With ASP.NET Core now released, I was wondering what the best hosting option is for Linux and Mac environments. Is there any production grade web server under active development?

The only one I'm aware of is Kestrel that ships with the framework. From the docs, it appears that Kestrel is missing several features in comparison with IIS

This Stackoverflow answers suggests that .NET Core apps would work with any HTTP server. Does this mean it will work with say, Apache? Would it be missing any features if so? I was under the impression that it works only with OWIN based servers. Am I missing something?

Solution

Use Kestrel, it's the way going forward. Refer to this: Change to IIS hosting model.

Does this mean it will work with say, Apache?

Yes and indeed that's the recommended approach. However, never expose Kestrel to outside world directly. Always put it behind a web server like nginx, IIS, HAProxy or Apache. More about Kestrel:

• ASP.NET 5: Kestrel
• ASP.NET 5: Considerations for Production Linux Environments

Some examples of using those reverse proxies:

• NGINX Reverse Proxy and Load Balancing for ASP.NET 5 Applications
• ASP.NET Core Authentication in a Load Balanced Environment with HAProxy and Redis

Comments

[Sergey Kostrukov]

How does DotNetty correlate with Kestrel? Are they serve different niches?

[Felix C]

Why is it not recommended to expose Kestrel to the outside world?

[tugberk]

AFAIK, It still has problems and can get you into trouble in terms of perf wise and security point of view. However, I are skeptical about telling the details. Ask here to get more details from the security man behind ASP.NET: twitter.com/blowdart/status/704366493270564864

[niceman]

can't asp.net work directly with Apache without kestral ?

[The Muffin Man]

If you have to put Kestrel behind IIS, why introduce the additional complexity, why not just only use IIS?

[Professor of programming]

Why is Apache the recommended approach over IIS?

[tugberk]

@Bonner who said that?

[Professor of programming]

@tugberk, sorry I missed that this relates to a *nix machine.

[Jacques Snyman]

From docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/… "A reverse proxy is required for edge deployments (exposed to traffic from the Internet) for security reasons. Kestrel is relatively new and does not yet have a full complement of defenses against attacks. This includes but isn't limited to appropriate timeouts, size limits, and concurrent connection limits."