Read additional KestrelServerOptions from config

[Tratcher]

The new configuration APIs will read endpoints with their certificates and the default certificate. aspnet/KestrelHttpServer#2186

Here are other KestrelServerOptions to consider reading from config (Unsorted):

• bool AddServerHeader
• SchedulingMode ApplicationSchedulingMode
• KestrelServerLimits Limits
  • long? MaxResponseBufferSize
  • long? MaxRequestBufferSize
  • int MaxRequestLineSize
  • int MaxRequestHeadersTotalSize
  • int MaxRequestHeaderCount
  • long? MaxRequestBodySize
  • TimeSpan KeepAliveTimeout
  • TimeSpan RequestHeadersTimeout
  • long? MaxConcurrentConnections
  • long? MaxConcurrentUpgradedConnections
  • MinDataRate MinRequestBodyDataRate
  • MinDataRate MinResponseDataRate
• Per Endpoint ListenOptions
  • bool NoDelay
  • HttpProtocols Protocols f38f60f
• Per Https Endpoint HttpsConnectionAdapterOptions
  • ClientCertificateMode ClientCertificateMode
  • SslProtocols SslProtocols
  • bool CheckCertificateRevocation
  • TimeSpan HandshakeTimeout

Today these must all be set in code in parallel to the configuration.

[RehanSaeed]

If anyone wants to set limits from config today, it can be done with a few extra lines of code:

.UseKestrel(
    (builderContext, options) =>
    {
        options.AddServerHeader = false;
        // Configure Kestrel from appsettings.json.
        options.Configure(builderContext.Configuration.GetSection("Kestrel"));

        // Configuring Limits from appsettings.json is not supported.
        // So we manually copy them from config.
        // See https://github.com/aspnet/KestrelHttpServer/issues/2216
        var kestrelOptions = builderContext.Configuration.GetSection<KestrelServerOptions>("Kestrel");
        foreach (var property in typeof(KestrelServerLimits).GetProperties())
        {
            var value = property.GetValue(kestrelOptions.Limits);
            property.SetValue(options.Limits, value);
        }
    })

  "Kestrel": {
    // Set stricter default limits to defend against various types of attacks.
    // See https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-2.1&tabs=aspnetcore2x#how-to-use-kestrel-in-aspnet-core-apps
    // And https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.server.kestrel.core.kestrelserverlimits?view=aspnetcore-2.1
    "Limits": {
      "MaxConcurrentConnections": 100, // Default is null (i.e. no maximum)
      "MaxConcurrentUpgradedConnections": 100, // Default is null (i.e. no maximum)
      "MaxRequestBodySize": 10240, // 10240 = 10KB. Default is 30MB. Use [RequestSizeLimit(100000000)] attribute to use more.
      "MaxRequestHeaderCount": 50 // Default is 100
    }
  },

[Tratcher]

options.Configure(builderContext.Configuration.GetSection(nameof(ApplicationOptions.Kestrel))); shouldn't be needed in that example if you're calling CreateDefaultBuilder first, it's cumulative.

[RehanSaeed]

You're right. I'm not using it because it's too much magic for my taste but other peoples mileage may vary.

[stukselbax]

Any progress on issue? Will you plan to add this to WebHost.CreateDefaultBuilder() method?

[Tratcher]

Is there any specific fields you're interested in? We haven't seen much demand.

[stukselbax]

Currently we tweaked two properties:

MinRequestBodyDataRate
MaxRequestBodySize

It is reasonable to allow configure all listed settings. Who knows where it applicable? For example, if some microservice is published, there is practically no options for maintainers of running service to change those options, if circumstances require it.

[stukselbax]

BTW, I could not find generic method .GetSection<KestrelServerOptions>("Kestrel"), so we end up with the following (checked with 2.1.1):

UseKestrel((builderContext, options) =>
{
    var kestrelSection = builderContext.Configuration.GetSection(KestrelSectionName);
    options.Configure(kestrelSection);

    var kestrelOptions = kestrelSection.Get<KestrelServerOptions>();
    if (kestrelOptions != null)
    {
        options.AddServerHeader = kestrelOptions.AddServerHeader;
        options.AllowSynchronousIO = kestrelOptions.AllowSynchronousIO;
        options.ApplicationSchedulingMode = kestrelOptions.ApplicationSchedulingMode;
        foreach (var property in typeof(KestrelServerLimits).GetProperties())
        {
            var value = property.GetValue(kestrelOptions.Limits);
            property.SetValue(options.Limits, value);
        }
    }
});

[ffMathy]

I could really use this. Currently on Azure App Service with ASP .NET Core 2.2, you will get a 500.30 error on startup if you try to modify AddServerHeader to false.

Quite critical in my opinion.

[Tratcher]

@ffMathy do you have more information on that? It's not clear why setting AddServerHeader would be a problem or how this feature would address that.