Is there a way to use Kestrel within a console/desktop app without requiring the installation of the ASP.NET runtime?

[ITESMEDIA]

Hello,
We have a desktop app that has a small need to run a local HTTP server to serve some files, we would like to use the latest version of Kestrel to do this but I don't believe that Kestrel is still distributed as Nuget packages anymore.

We have added the FrameworkReference Microsoft.AspNetCore.App to our project but now running our app requires both the Desktop runtime and the ASP.NET runtime, which is not ideal.

Any suggestions on how we could ship the Kestrel assemblies as part of our app? Are we looking for trouble by attempting this?
We would like to avoid self-contained deployment for now for other reasons.

Thanks!

[engineering87]

Hello @ITESMEDIA,
you can use Kestrel in a desktop app without pulling in the full ASP.NET shared framework or using <FrameworkReference Include="Microsoft.AspNetCore.App" />.
Instead, add only the required NuGet packages:

<PackageReference Include="Microsoft.AspNetCore.Server.Kestrel" Version="8.0.0" />
<PackageReference Include="Microsoft.Extensions.Hosting" Version="8.0.0" />

using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.Hosting;

var builder = Host.CreateDefaultBuilder()
    .ConfigureWebHostDefaults(webBuilder =>
    {
        webBuilder.UseKestrel()
            .UseUrls("http://localhost:5000")
            .Configure(app =>
            {
                app.UseStaticFiles();
            });
    });

await builder.Build().RunAsync();

[ITESMEDIA]

Hello @engineering87,
Thanks for the suggestion but there does not seem to be a newer version than 2.3 of Microsoft.AspNetCore.Server.Kestrel on nuget.org. Do you know of any other way to get more up to date packages for ASP.NET Core and Kestrel?

[martincostello]

For versions 3.0+ <FrameworkReference Include="Microsoft.AspNetCore.App" /> has to be used. Individual NuGet packages are no longer published.

[gfoidl]

Well Kestrel is a full flegded server. When it's really just something simple needed, as alluded by (at least what I interpret)

small need to run a local HTTP server to serve some files

then a simple implemenation based on HttpListener could also work.
But bear in mind that security features, etc. are hard to get rights, so when used outside of the local desktop and local files you should use a "real" server (like Kestrel).

Out of curiosity, can you eloberate more no

We have a desktop app that has a small need to run a local HTTP server to serve some files

i.e. why this is needed?

[ITESMEDIA]

We're running Chromium within our .NET app to display a webpage that needs to have access to both remote files using HTTPS and local files in a specific folder on disk. We have looked at multiple options to mix both file:// and https:// within the same page, but we always ended up with a blocker due to Chromium security features and the specific needs of some of our use cases. We also explored other options that ended up having stability or performance issues.

Using an HTTP server like Kestrel or a very basic configuration of ASP.NET Core allows us to tell the page to load all of its file from that local server and from there we can either return the local file or return a 301 redirect toward the online version without triggering any of the Chromium security limitations. This server only listens on localhost on devices that are meant to be exclusively running our app so there aren't too many security implications.

I was not aware of HttpListener but it does seem too simple not just for security but also performance of processing potentially large files and more complex requests (Chromium does Range requests for videos).

[ITESMEDIA]

For now we ended up replicating what a self-contained app does, but we only include the ASPNET.Core DLL files from the binary distribution and not the entire framework. It helps not to increase the filesize too much while not requiring to deploy all of our apps from that packages as self-contained (which could cause a lot of duplicate files).