27

What is the reason for two separate but similar servers? What are the differences? Can I run both in docker? Do both support same things, like all authentication types?

RickAndMSFT
  • 20,912
  • 8
  • 60
  • 78
jjaskulowski
  • 2,524
  • 3
  • 26
  • 36
  • 6
    pretty sure weblistener is windows only, kestrel is cross platform – Joe Audette Aug 31 '16 at 11:26
  • 5
    Read the docs! https://docs.asp.net/en/latest/fundamentals/servers.html :) – DavidG Aug 31 '16 at 11:29
  • If Kestrel is cross platform then whey can't them make it support all options that work for windows on WebListener. Why do I have to hardcode in my app Main what type of server am I going to use?! – jjaskulowski Aug 31 '16 at 11:46
  • 1
    The docs are lacking on this question, @DavidG. The section [Choosing a server](https://docs.asp.net/en/latest/fundamentals/servers.html#choosing-a-server), which should be the canonical answer to this question, doesn't even mention WebListener, much less offer guidance about when to choose it. – Edward Brey Oct 12 '16 at 14:13
  • @EdwardBrey Then feel free to [update the docs](https://github.com/aspnet/Docs/blob/master/aspnet/fundamentals/servers.rst) if you feel they need more info – DavidG Oct 12 '16 at 14:55
  • @DavidG That would be a great suggestion if I knew the answer. I fell back to the next best option, which is to [log an issue](https://github.com/aspnet/Docs/issues/1959) to alert someone who does. – Edward Brey Oct 12 '16 at 18:23
  • 1
    I now know that Kestler does not support windows auth but why would someone create two projects instead of just making one server in modular architecture and support some modules on windows and some on linux. And then if you add issues like that one when simple change ÜseKestler tu UseWeblistener will instantly make website crashing on iis express... Then you have to work hard to make your project run on all types of servers which is like... contradictory to making things abstract and independednt - what it was all about... – jjaskulowski Oct 13 '16 at 06:25

3 Answers3

47

Kestrel vs HTTP.sys - I've highlighted the fundamental differences below.

(The words are Microsoft's and I've only edited it for brevity and clarity. See the sources linked at the bottom).

Update:

Kestrel previously always required the use of a reverse proxy with edge deployments (exposed to traffic from the Internet) for security reasons. With Kestrel in ASP.Net Core 2.x this is no longer the case. Take a look at the documentation for more information. Kestrel Web Server Documentation

Kestrel 1.x vs 2.x

Weblistener was renamed HTTP.sys in ASP.NET Core 2.0

Sources:

  1. Docs.Microsoft.com Web server implementations in ASP.NET Core
  2. Docs.Microsoft.com HTTP.sys web server implementation in ASP.NET Core

HTTP.sys is windows-only HTTP / Web Server for ASP.NET Core that allows you to expose the server directly to the Internet without needing to use IIS. HTTP.sys is built on top of Http.Sys ( the same mature technology that also powers IIS' HTTP Listener) as is as such very feature rich and provides protection against various attacks.

Kestrel on the other hand, is a cross-platform web server for ASP.NET Core that is designed to be run behind a proxy (for example IIS or Nginx) and should not be deployed directly facing the Internet. Kestrel is relatively new and does not have a full complement of defenses against attacks. It's also not as feature rich as HTTP.sys and comes with timeout limits, size limits and concurrent user limits.

In essence, the choice comes down to your web application's Deployment scenario.

HTTP.sys Use Cases :

enter image description here

Kestrel Use Cases :

enter image description here

RickAndMSFT
  • 20,912
  • 8
  • 60
  • 78
Shiva
  • 20,575
  • 14
  • 82
  • 112
  • 1
    It's worth mentioning that for proper protection you'll want a Web Application Firewall anyway (e.g. using Azure Application Gateway). – Ohad Schneider May 29 '17 at 13:41
  • 1
    FWIW `concurrent connection limits` means with kestrel you can load the server until it fractures, whereas with IIS will queue requests, run them slower, and only under extreme load return service unavailable errors whereas kestrel will eventually stop responding appropriately. – Chris Marisic Feb 27 '18 at 22:58
  • Update: `Http.sys` is the new name of `WebListener`: [HTTP.sys web server implementation in ASP.NET Core](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys?view=aspnetcore-2.2) – ctekse Oct 28 '19 at 08:54
4

Following comparison will help you to choose which one is better

enter image description here

divyang4481
  • 1,584
  • 16
  • 32
3

The ASP.NET 5 documentation (created by Microsoft on August 25, 2015) found here lists the chart found in the other answer (see page 107 of the bottom right book pages, but page 111 of the PDF): https://media.readthedocs.org/pdf/aspnet/theming/aspnet.pdf

Kestrel in general has better performance, if you used for one of the following below:

  • Great option if used in conjunction with a reverse proxy for apps exposed to Internet
  • Internal apps connecting with other internal apps on a private virtual network (not exposed to Internet)

WebListener is more secure, slower, and has more features. It is used in these cases:

  • Expose app to the Internet but can't use IIS Require higher security and exposing server directly to Internet.
  • Additional features: List item, Windows Authentication, Port sharing, HTTPS with SNI, HTTP/2 over TLS (Windows 10), Direct file transmission, Response caching
Crystal Tenn
  • 61
  • 5