Kestrel named pipes /n/1

aspnetcore/fundamentals/servers/kestrel/endpoints.md

@@ -581,6 +581,22 @@ The following example configures an endpoint for HTTP/1.1, HTTP/2, and HTTP/3 co
 
 :::code language="csharp" source="~/fundamentals/servers/kestrel/samples/6.x/KestrelSample/Snippets/Program.cs" id="snippet_ConfigureKestrelProtocols":::
 
+:::moniker-end
+
+:::moniker range=">= aspnetcore-9.0"
+
+## Customize Kestrel named pipe endpoints
+
+Kestrel's named pipe support includes advanced customization options. The [CreateNamedPipeServerStream](/dotnet/api/microsoft.aspnetcore.server.kestrel.transport.namedpipes.namedpipetransportoptions.createnamedpipeserverstream) property on the named pipe options allows pipes to be customized per-endpoint.
+
+This is useful, for example, in a Kestrel app that requires two pipe endpoints with different [access security](/windows/win32/ipc/named-pipe-security-and-access-rights). The `CreateNamedPipeServerStream` option can be used to create pipes with custom security settings, depending on the pipe name.
+
+:::code language="csharp" source="~/fundamentals/servers/kestrel/endpoints/samples/KestrelNamedEP/Program.cs" highlight="15-33" id="snippet_1":::
+
+:::moniker-end
+
+:::moniker range=">= aspnetcore-8.0"
+
 ## See also
 
 * <xref:fundamentals/servers/kestrel>

aspnetcore/fundamentals/servers/kestrel/endpoints/samples/KestrelNamedEP/Program.cs

@@ -1,21 +1,42 @@
+// <snippet_1>
 using System.IO.Pipes;
+using System.Security.AccessControl;
+using System.Security.Principal;
 
 var builder = WebApplication.CreateBuilder();
 
 builder.WebHost.ConfigureKestrel(options =>
 {
-    options.ListenNamedPipe("pipe1");
-    options.ListenNamedPipe("pipe2");
+    options.ListenNamedPipe("defaultPipe");
+    options.ListenNamedPipe("securedPipe");
 });
 
 builder.WebHost.UseNamedPipes(options =>
 {
     options.CreateNamedPipeServerStream = (context) =>
     {
-        var pipeSecurity = CreatePipeSecurity(context.NamedPipeEndpoint.PipeName);
+        var pipeName = context.NamedPipeEndPoint.PipeName;
+
+        switch (pipeName)
+        {
+            case "defaultPipe":
+                return NamedPipeTransportOptions.CreateDefaultNamedPipeServerStream(context);
+            case "securedPipe":
+                var allowSecurity = new PipeSecurity();
+                allowSecurity.AddAccessRule(new PipeAccessRule("Users", PipeAccessRights.FullControl, AccessControlType.Allow));
 
-        return NamedPipeServerStreamAcl.Create(context.NamedPipeEndPoint.PipeName, PipeDirection.InOut,
-            NamedPipeServerStream.MaxAllowedServerInstances, PipeTransmissionMode.Byte,
-            context.PipeOptions, inBufferSize: 0, outBufferSize: 0, pipeSecurity);
+                return NamedPipeServerStreamAcl.Create(pipeName, PipeDirection.InOut,
+                    NamedPipeServerStream.MaxAllowedServerInstances, PipeTransmissionMode.Byte,
+                    context.PipeOptions, inBufferSize: 0, outBufferSize: 0, allowSecurity);
+            default:
+                throw new InvalidOperationException($"Unexpected pipe name: {pipeName}");
+        }
     };
 });
+
+var app = builder.Build();
+
+app.MapGet("/", () => "Hello World!");
+
+app.Run();
+// </snippet_1>