The art of simplicity

On-premises VMs don't disappear just because you are working on a cloud strategy. We are running a lot of Windows workloads on-prem — application pools, Windows services, scheduled tasks — and still need visibility into whether they're healthy. Traditional on-prem monitoring solutions could work, but they come with their own operational overhead and are directly tied to our on-premise infrastructure. When an incident happens, we don’t want to context-switch between our cloud monitoring stack and our on-prem monitoring stack. It's not ideal. We wanted a single, cloud-native view into the health of our on-prem workloads without having to lift and shift them into Azure. Azure Arc made this possible by extending Azure's management plane to our on-premises infrastructure. By combining Arc with Log Analytics and Workbooks, we built a unified health dashboard that sits alongside our cloud monitoring, uses the same query language (KQL), and requires no additional on-prem in...

As we see security as a top priority, for every new application that we put in production, we let it be penetration tested first. One remark we got with the last pen test was about the information our servers inadvertently revealed through HTTP response headers. Although I think it is not the biggest possible security issue, exposing details about their technology stack through headers like Server and X-Powered-By , gives some reconnaissance information to potential attackers for free. n this post, we'll explore why you should hide these headers and demonstrate several methods to remove or customize them in ASP.NET Core applications. Generated with Bing Image Creator Why hide server headers? Server identification headers might seem harmless, but they can pose security risks: Information Disclosure : Headers like Server: Kestrel or X-Powered-By: ASP.NET immediately tell attackers what technology stack you're using, making it easier for them to target known vulnerabili...

I know, I know, .NET 10 is already in preview and I am still catching up on what was added to .NET 9.0. Today while upgrading an older application to .NET 9, I decided to have a look at the new static file handling introduced in .NET 9 through the MapStaticAssets feature. Static File middleware (before .NET 9) Before .NET 9, static files(Javascript, CSS, images, …) were handled through the UseStaticFiles middleware This middleware is still there as the new MapStaticAssets feature does not support all the features that the original middleware had. From the documentation : Serving files from disk or embedded resources, or other locations Serve files outside of web root Set HTTP response headers Directory browsing Serve default documents FileExtensionContentTypeProvider Serve files from multiple locations Serving files from disk or embedded resources, or other locations Serve files outside of web root Set HTTP response headers Direc...

A while back I talked about a memory leak we had in one of our applications. As a consequence, it brought the full production environment to a halt impacting not only the causing application but all applications hosted on the same IIS instance. Although we found the root cause and fixed the problem, we did a post-mortem to discuss on how to avoid this in the future. In this post, I'll walk you through the practical strategies we implemented to limit and optimize memory usage for our applications running in Internet Information Services (IIS). n this guide, I'll walk you through practical strategies to limit and optimize memory usage for applications running in Internet Information Services (IIS). Understanding memory usage in IIS Before diving into solutions, it's important to understand how IIS manages memory. IIS runs web applications in application pools, which are processes (w3wp.exe) that host your web applications. Each application pool can consume memory ind...

Ever heard about the 403.16 HTTP error response code? I certainly did not. But it was exactly this error code we got back after configuring IIS to expect a client certificate. In this post I’ll explain how we tackled the issue and found a solution(workaround?). How to configure IIS to expect a client certificate? First step is to enable SSL on IIS: Open IIS Manager . Select your site and click Bindings . Add or edit an HTTPS binding and select a valid SSL certificate . Now we need to configure our website so that it requires a client certificate: In IIS Manager, select your site. Click SSL Settings . Check Require SSL . Under Client certificates , select Require . Click on Apply . A last optional step is to configure client certificate mapping: Navigate to Authentication settings. Enable IIS Client Certificate Mapping Authentication . Remar...

A colleague reached out to me with a specific scenario he had to tackle. He had an IIS hosted ASP.NET Core application using Windows Authentication where he had to execute a specific action on behalf of the current user. The typical way to do this is through impersonation. In this post I’ll explain what impersonation is and how you can get this working in ASP.NET Core. What is impersonation? Impersonation is a security feature that allows an application to execute code under the context of a different user identity. This capability is often used when an application needs to access resources, such as files, databases, or network services, with permissions different from those of the current user or the application's process. By using impersonation the application temporarily assumes the identity of another user to perform specific actions, reverting back to its original identity afterward. Some common use cases for impersonation are: Accessing network shares or file sys...

In the world of software development, safeguarding sensitive data is paramount, especially when it comes to configuration settings that may include passwords, API keys, and connection strings. ASP.NET Core provides a robust mechanism for managing such sensitive data during development through the use of a secrets.json file. This feature is part of a broader configuration system that allows developers to store and retrieve application settings in a variety of ways, including environment variables, command-line arguments, and external files. The secrets.json file is a secure and convenient place to store confidential information that is specific to your development environment. It is not checked into source control, which means your secrets are not exposed when your code is shared or published. Instead, the secrets.json file resides in a system-protected user profile folder on your machine, keeping your secrets outside your main source tree avoiding that you accidently check-in and sha...

At one of my customers, we are still (happily) using Microsoft Web Deploy to deploy our web applications to IIS. This works great and is all nicely automated and integrated in our Azure DevOps pipelines. Until the moment it no longer works. Something that happened last month when trying to deploy one of our projects. A look at the web deploy logs showed us the following error message: Web deployment task failed. ((2/11/2024 15:00:08) An error occurred when the request was processed on the remote computer.)(2/11/2024 15:00:08) An error occurred when the request was processed on the remote computer.Unable to perform the operation. Please contact your server administrator to check authorization and delegation settings. Time to contact the server administrator... Unfortunately that’s my team in this case. So let’s investigate. We logged in on the web server and checked the event logs. There we got some extra details: A tracing deployment agent exception occurred that was propagat...

At one of my customers, everything is still on premise hosted on multiple IIS web servers. To deploy web applications, we are using Web Deploy . This works quite nicely and allows us to deploy web application in an automated way. Last week, a colleague contacted me after configuring the deployment pipeline in Azure DevOps. When the pipeline tried to deploy the application, it failed with the following error message: "System.Exception: Error: Source does not support parameter called 'IIS Web Application Name'. Must be one of (Environment)" Here is a more complete build log to get some extra context: Starting deployment of IIS Web Deploy Package : \DevDrop\BOSS.Intern.Web.zip">\DevDrop\BOSS.Intern.Web.zip">\DevDrop\BOSS.Intern.Web.zip">\DevDrop\BOSS.Intern.Web.zip">\\<servername>\DevDrop\BOSS.Intern.Web.zip Performing deployment in parallel on all the machines. Deployment started for machine: <servername> with port...

Yesterday I talked about Log Parser and Log Parser Studio as tools to help parse files(in my case IIS log files). I was struggling to find a way to parse IIS Log files with custom fields in Log Parser Studio. I solved it by directly calling log parser. However after writing my post yesterday I continued experimenting a little bit and I noticed that when I changed the log type from IISW3C logs to W3C logs, Log Parser Studio was able to process the files and return results.   I don’t know why I didn’t try this before. But the good news is it works!

Although a really old tool, I still use Log Parser from time to time to parse log files. It is really fast and can parse large amount of data in a short time. And if you are afraid of the complexity of the tool, you can first try the Log Parser Studio which simplifies the usage of Log Parser. My main use case is to parse IIS logs and extract useful information from it. However recently Log Parser no longer processed the IIS log files and the results remained empty. What is going on?! Let’s find out… The first thing I noticed that was different compared to before is that the IIS Log files had a slightly different naming format; a ‘_x’ was added to every log file: Inside the documentation I found the following explanation: Once custom fields have been configured, IIS will create new text log files with "_x" appended to the file name to indicate that the file contains custom fields. And indeed when I check the log file I could see that a few ‘crypt-‘ fields are adde...

About 2 years ago I blogged about the possibility to collect performance counter data as part of your Application Insights telemetry. If you missed the original post, first have a quick read here and then come back. Back? As mentioned in the original post, to be able to collect this performance data, the Application Pool user needs to be added to both the Performance Monitor Users and Performance Log Users group. Although I updated our internal wiki to emphasize this, I still noticed that most developers forget to do this with no collected data as a result. (Who reads documentation anyway?) So let’s do what any developers does in this case, let’s automate the problem away… I created a small tool that can be executed on the IIS web server. It goes through all the application pools, extracts the corresponding user and add it to the 2 groups as mentioned above. I think the code is quite self-explanatory. Here is the part where I read out the application pools: And here I ad...

One of our production servers started to send out alerts because the memory consumption was too high. A first look at the server showed us that one of the w3wp processes was consuming most of the available resources on the server.   Sidenote: Web applications running within Microsoft’s Internet Information Services (IIS) utilize what is known as IIS worker processes. These worker processes run as w3wp.exe, and there are typically multiple per server. So we knew that one of our web applications was causing trouble. The question of course now is which one? As the resource manager only showed us the process id, we couldn’t immediately give the answer. But with some extra command line magic we got the answer. To get the information we need we used the appcmd utility. This tool allows; among other things; to list the IIS worker processes. We executed appcmd list wps and got the the list of worker processes with their PIDs. c:\Windows\System32\inetsrv>appcmd list wps ...

In our move to improve security in our api landscape, we configured a global redirect rule in IIS to redirect calls to HTTPS. An unforeseen consequence was that for our (old) WCF services, the WSDL endpoints were no longer accessible. When someone clicks on the WSDL link, a redirect happens but on the https endpoint no metadata is available. To fix it, I had to update the WCF configuration to explicitly enable the metadata endpoint on HTTPS:

By default when running an ASP.NET Core application in IIS, the application will not be started until the first user hits your ASP.NET Core application. This of course saves some resources(CPU, memory,...) when no one is accessing your site, but comes with a performance penalty when the first request arrives. A related feature exists where the application pool is shutdown after some idle time. Although I think this is a good default it is not what we want when we have one or more background tasks running in our ASP.NET Core application . In these situations you want to have your ASP.NET Core application always running. Let me walk you through the steps how to get this done. Install IIS features First check if you have the Application Initialization Module installed in IIS. If you are doing this on your local development machine, have a look at the list of Windows Features: Otherwise you can install it through Server Manager: Open the Add Roles and Features Wizard ....

When trying to publish an ASP.NET Core web application through the dotnet publish command on our build server, it failed with the following error message: C:\Program Files\dotnet\sdk\7.0.201\Sdks\Microsoft.NET.Sdk.Publish\targets\TransformTargets\Microsoft.NET.Sdk.Publish.TransformFiles.targets(50,5): error MSB4018: The "TransformWebConfig" task failed unexpectedly. [D:\b\3\_work\222\s\SOFACore\Example\eShopExample\eShopExample.csproj] C:\Program Files\dotnet\sdk\7.0.201\Sdks\Microsoft.NET.Sdk.Publish\targets\TransformTargets\Microsoft.NET.Sdk.Publish.TransformFiles.targets(50,5): error MSB4018: System.Exception: In process hosting is not supported for AspNetCoreModule. Change the AspNetCoreModule to at least AspNetCoreModuleV2. [D:\b\3\_work\222\s\SOFACore\Example\eShopExample\eShopExample.csproj] C:\Program Files\dotnet\sdk\7.0.201\Sdks\Microsoft.NET.Sdk.Publish\targets\TransformTargets\Microsoft.NET.Sdk.Publish.TransformFiles.targets(50,5): error MSB4018: at Microsoft.N...

I think everyone agrees that using HTTPS for your web applications is the default. Therefore it makes sense to have the HttpsRedirection middleware always active in your ASP.NET Core application: However when I tried to run this ASP.NET Core application using IIS Express , I always arrived at the root url of my local IIS instance( https://localhost/ ): I found the source of this behaviour in the launchsettings.json file where I had only http configured: The https middleware causes the redirect to https but as there is no IIS Express https endpoint active I end up on https://localhost (and get the default IIS web page): The solution is to active an https endpoint by specifying the sslPort :

In our continuous effort to improve security measures and evolve to a 'least privilege' setup, we started to remove user access to disks on our IIS web servers. For most applications this turned out not be an issue, but applications using Windows Authentication started to fail. Let’s investigate what is happening and how we can fix this. Anonymous Authentication Let me first explain what is going on for applications that are not using Windows Authentication . These applications are configured to use Anonymous Access and the anonymous user identity is set to a specific user account or the Application pool identity. This means that only these users needs to have access to the folders on disk. Windows Authentication Once we move to Windows Authentication the situation gets more complex. Now the user that is authenticated needs access on disk to be able to access the site. So probably the easiest solution would be to grant the user access to disk (or just give the Every...

In our continuous effort to improve the security of the solutions we build, we activated HSTS at one of our clients. However I noticed that there was a lack of understanding on what HSTS exactly is and how it helps to improve security. Hence this blog post. What is HSTS? Let’s ask Wikipedia : HTTP Strict Transport Security ( HSTS ) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking . It allows web servers to declare that web browsers (or other complying user agents ) should automatically interact with it using only HTTPS connections. In short HSTS tells a browser to only access a site through HTTPS. Enabling HSTS in IIS Let me first show you to enable it in IIS before I get into more detail. Open IIS (InetMgr) Click on the website where you want to activate HSTS. Remark: HSTS is always activated at the site level. On the Manage Website se...

A team member contacted me because he no longer could invoke a local service he was developing. I had a look at the error message the API returned: One or more errors occurred. An error occurred while sending the request. The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. The remote certificate is invalid according to the validation procedure This was a local service using a self-signed certificate and it turned out that the certificate was expired. Time to create a new self-signed certificate… Create a self-signed certificate using dotnet dev-certs Generating a new self-signed certificate is easy in .NET Core thanks to the built-in support in the dotnet commandline tool. Open a command prompt and execute the following command: dotnet dev-certs https -ep c:\users\BaWu\localhost.pfx -p crypticpassword Remark:   If the command returns the following response "A valid HTTPS certificate is alrea...