You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -30,17 +56,158 @@ This is a versatile http server designed to be used in mobile/UWP applications.
30
56
* This HTTP server is not designed for performance or high capacity
31
57
* It's perfect for small applications, or small need, like to act as _return url_ for OAuth2 authentication using external browser.
32
58
59
+
## Features
60
+
* Simple, lightweight, self-contained HTTP server
61
+
* Supports IPv4 and IPv6
62
+
* Supports HTTP 1.1 (limited: no keep-alive, no chunked encoding)
63
+
* Supports GET, POST, PUT, DELETE, HEAD, OPTIONS, TRACE, PATCH - even custom methods
64
+
* Supports static files
65
+
* Supports custom headers
66
+
* Supports custom status codes
67
+
* Supports custom content types
68
+
* Supports custom content encodings
69
+
* Supports dependency injection and configuration via `IOptions<ServerOptions>`
70
+
* Configurable bind addresses and hostnames for IPv4/IPv6
71
+
* Supports dynamic port assignment
72
+
73
+
## Common use cases
74
+
* Return URL for OAuth2 authentication using external browser
75
+
* Remote diagnostics/monitoring on your app
76
+
* Building a headless Windows IoT app (for SSDP discovery or simply end-user configuration)
77
+
* Any other use case where you need to expose a simple web server
78
+
33
79
## Limitations
34
80
* There is no support for HTTP 2.0+ (yet) or WebSockets
35
81
* There is no support for HTTPS (TLS)
36
82
37
-
## What you can do with it
38
-
* Use it for building a headless Windows IoT app (for SSDP discovery or simply end-user configuration)
39
-
* Use it for remote diagnostics/monitoring on your app
83
+
## Security and Intended Use (No TLS)
84
+
This server uses plain HTTP with no transport encryption. It is primarily intended for:
85
+
- Localhost usage (loopback) during development or as an OAuth redirect target.
86
+
- Internal communication on trusted networks, e.g., between Docker containers on the same host or in a private overlay network.
87
+
- Embedded/local scenarios (IoT, diagnostics) where transport security is handled elsewhere.
88
+
89
+
If you need to expose it on a public or untrusted network:
90
+
- Put it behind a reverse proxy that terminates TLS (e.g., Nginx, Traefik, Caddy, IIS/ASP.NET Core reverse proxy) and forward to this server over HTTP on a private interface.
91
+
- Alternatively, use a secure tunnel (SSH, Cloudflare Tunnel, etc.).
92
+
- Bind to loopback only (127.0.0.1 / ::1) when you want to ensure local-only access.
93
+
94
+
Note: Authentication/authorization is not built-in; implement it in your handlers or at the proxy layer as needed.
95
+
96
+
## Configuration and Dependency Injection
97
+
98
+
The server can now be configured via a `ServerOptions` POCO. You can construct `Server` directly with a `ServerOptions` instance, or register it with Microsoft.Extensions.DependencyInjection using `IOptions<ServerOptions>`.
99
+
100
+
### ServerOptions Properties
101
+
102
+
*`Port` - Port number to listen to (0 = dynamic)
103
+
*`BindAddress4` - IPv4 address to bind the listener to (defaults to `IPAddress.Any`)
104
+
*`BindAddress6` - IPv6 address to bind the listener to (defaults to `IPAddress.IPv6Any`)
105
+
*`Hostname4` - Hostname used to compose the public IPv4 URI (defaults to "127.0.0.1")
106
+
*`Hostname6` - Hostname used to compose the public IPv6 URI (defaults to "::1")
107
+
108
+
### Dynamic Port Assignment (Recommended)
109
+
110
+
Using port `0` enables **dynamic port assignment**, which is the **recommended approach** for most applications:
111
+
112
+
**Key Advantages:**
113
+
-**Zero port conflicts**: The operating system automatically assigns an available port
114
+
-**Perfect for testing**: Multiple test instances can run simultaneously without conflicts
115
+
-**Microservices architecture**: Each service gets its own unique port automatically
116
+
-**Team collaboration**: No need to coordinate port assignments between developers
117
+
-**CI/CD friendly**: Parallel builds and tests work seamlessly
118
+
119
+
**Best Practices with Dynamic Ports:**
120
+
121
+
```csharp
122
+
// ✅ Recommended: Use dynamic ports (default behavior)
This allows you to control the bind addresses and hostnames used to compose the public URIs that the server logs, which is especially useful for OAuth callbacks and REST API applications.
207
+
208
+
## Tips
209
+
210
+
### Opening port on Windows 10 IoT (typically on a Raspberry Pi)
44
211
If you want to open "any" port on a Raspberry Pi running Windows 10 IoT, you may
0 commit comments