title: How to make ASP.NET Core app (service not IIS) reachable from network
body: <p>I got a ASP.NET Core application, which I configured to run as a service (so there is no IIS on target maschine). Also, I want to use HTTP.sys.
  My configuration looks like this:</p>
  
  <pre><code>var host = WebHost.CreateDefaultBuilder(args)
              .UseContentRoot(pathToContentRoot)
              .UseHttpSys(options =&gt;
              {
                  // The following options are set to default values.
                  options.Authentication.Schemes = AuthenticationSchemes.None;
                  options.Authentication.AllowAnonymous = true;
                  options.MaxConnections = null;
                  options.MaxRequestBodySize = 30000000;
                  options.UrlPrefixes.Add("http://localhost:5050");
              })
              .UseStartup&lt;Startup&gt;()
              .UseApplicationInsights()
              .Build();
  
          if (isService)
          {
              host.RunAsService();
          }
          else
          {
              host.Run();
          }   
  </code></pre>
  
  <p>Look at the line </p>
  
  <pre><code>options.UrlPrefixes.Add("http://localhost:5050");
  </code></pre>
  
  <p>This is pretty much standard. But: if I publish this application and install the service on a PC in my network, I cant reach it. </p>
  
  <p>The PC has an IP, for example 10.35.39.113, and I can ping it. But when I try to connect via a browser (from another PC in LAN), open up <em><a href="http://10.35.39.113:5050/" rel="nofollow noreferrer">http://10.35.39.113:5050/</a></em> it says error <strong>400 "Bad Request"</strong>.</p>
  
  <p>I added rules to the firewall, I disabled the firewall, I run</p>
  
  <blockquote>
    <p>netsh http add urlacl url=<a href="http://+:5050/" rel="nofollow noreferrer">http://+:5050/</a> user=Users</p>
  </blockquote>
  
  <p>but it did not work. The error changed from <strong>400 "Bad Request"</strong> to error <strong>503 "Service Unavailable"</strong>.</p>
  
  <p>I only got it working by changing the UrlPrefixes.Add line to:</p>
  
  <pre><code>options.UrlPrefixes.Add("http://*:5050");
  </code></pre>
  
  <p>But there is a big warning in the HTTP.sys documentation. <a href="https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys?view=aspnetcore-2.0" rel="nofollow noreferrer">Link to documentation</a></p>
  
  <blockquote>
    <p>Warning</p>
    
    <p>Top-level wildcard bindings (http://*:80/ and <a href="http://+:80" rel="nofollow noreferrer">http://+:80</a>) should not
    be used. Top-level wildcard bindings can open up your app to security
    vulnerabilities. This applies to both strong and weak wildcards. Use
    explicit host names rather than wildcards. Subdomain wildcard binding
    (for example, *.mysub.com) doesn't have this security risk if you
    control the entire parent domain (as opposed to *.com, which is
    vulnerable). See rfc7230 section-5.4 for more information.</p>
  </blockquote>
  
  <p>Now I ran out of ideas. </p>
  
  <p>What do I have to do to make my service reachable from the network?</p>