ASP.NET Core跨平台技术内幕

　　ASP.NET Core设计初衷是开源跨平台、高性能Web服务器，其中跨平台特性较早期ASP.NET是一个显著的飞跃，.NET现可以理直气壮与JAVA同台竞技，而ASP.NET Core的高性能特性更是成为致胜法宝。

ASP.NET Core 2.1+为IIS托管新增In-Process模型并作为默认选项（使用IISHttpServer替代了Kestrel，dotnet程序由IIS网站进程w3wp.exe内部托管）。

为了展示ASP.NET Core跨平台特性，本文还是重点着墨经典的Out-Process托管模型。

宏观模型

为解耦平台差异，程序内置Http服务组件Kestrel，由平台web服务器转发请求到Kestrel。

老牌web服务器定位成反向代理服务器，转发请求到ASP.Net Core程序（分别由IIS AspNetCore Module 和Nginx配置参数完成）

常规代理服务器，只用于代理内部主机对外网的连接需求，一般不支持外部对内部网络的访问请求；

当一个代理服务器能够代理外部网络的主机，访问内部网络，这种代理服务器被称为反向代理服务器。

平台web代理服务器、ASP.NET Core程序(dotnet.exe) 均为独立进程，平台自行决定互动细节，只需确保平台web服务器与Kestrel形成Http通信。

Kestrel

与老牌web服务器解耦，实现跨平台部署，要注意

进程内Http服务器，ASP.NET Core具备了基本web服务器的能力，在内网部署和开发环境完全可使用dotnet.exe自宿模式运行。
Kestrel定位是Http服务组件，实力还比不上老牌web服务器，在timeout机制、web缓存、响应压缩等不占优势，在安全性等方面还有缺陷。

因此在生产环境中必须使用老牌web服务器反向代理请求。

不同平台管控应用、转发请求

要实现企业级稳定部署：

*nix平台

将ASP.NET Core程序以dotnet.exe自宿模式运行，并配置为系统守护进程（管控应用），再由Nginx转发请求

以下使用systemd创建进程服务文件 /etc/systemd/system/kestrel-eqidproxyserver.service

[Unit]
Description=EqidProxyServer deploy on centos

[Service]
WorkingDirectory=/var/www/eqidproxyserver/eqidproxyServer
ExecStart=/usr/bin/dotnet /var/www/eqidproxyserver/eqidproxyServer/EqidProxyServer.dll
Restart=always
# Restart service after 10 seconds if the dotnet service crashes:
RestartSec=10
TimeoutStopSec=90
KillSignal=SIGINT
SyslogIdentifier=dotnet-example
User=root
Environment=ASPNETCORE_ENVIRONMENT=Production
Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false

[Install]
WantedBy=multi-user.target

sudo systemctl enable kestrel-eqidproxyserver.service 　　　　　　// 启用服务

安装Nginx，并配置Nginx转发请求;

server {
        listen       80;
        server_name  default_website;
        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

        location / {
        proxy_pass         http://localhost:5000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection keep-alive;
        proxy_set_header   Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        }
    }

Windows平台

[ 管控应用、转发请求] 由ASP.NET Core Module(插入在IIS Pipeline中的原生组件，下面简称ACM)一手操办。

w3wp.exe、dotnet.exe的互动关系是通过父子进程维系的。下图脚本力证dotnet.exe进程是w3wp.exe创建出来的子进程：

正因为如此，ACM在创建子进程时能指定子进程环境变量，约定donet.exe接收（IIS转发的请求）的侦听端口。

实际上从源码看ACM为子进程设定三个重要的环境变量：

ASPNETCORE_PORT　　约定 Kestrel将会在此端口上监听
ASPNETCORE_APPL_PATH
ASPNETCORE_TOKEN　约定携带该Token的请求为合法的转发请求

与ACM夫唱妇随的是UseIISIntegration()扩展方法，完成如下工作：

① 启动Kestrel服务在http://localhost:{ASPNETCORE_PORT}上监听

② 根据 {ASPNETCORE_TOKEN} 检查请求是否来自ACM转发

ACM转发的请求，会携带名为MS-ASPNETCORE-TOKEN:******的Request Header,以便dotnet.exe对比研判。

③ 利用ForwardedHeaderMiddleware中间件保存原始请求信息

linux平台部署需要手动启用ForwardedHeader middleware

https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1

源码快速验证：

namespace Microsoft.AspNetCore.Hosting
{
    public static class WebHostBuilderIISExtensions
    {
        // These are defined as ASPNETCORE_ environment variables by IIS's AspNetCoreModule.
        private static readonly string ServerPort = "PORT";
        private static readonly string ServerPath = "APPL_PATH";
        private static readonly string PairingToken = "TOKEN";
        private static readonly string IISAuth = "IIS_HTTPAUTH";
        private static readonly string IISWebSockets = "IIS_WEBSOCKETS_SUPPORTED";

        /// <summary>
        /// Configures the port and base path the server should listen on when running behind AspNetCoreModule.
        /// The app will also be configured to capture startup errors.
        public static IWebHostBuilder UseIISIntegration(this IWebHostBuilder hostBuilder)
        {
            var port = hostBuilder.GetSetting(ServerPort) ?? Environment.GetEnvironmentVariable($"ASPNETCORE_{ServerPort}");
            var path = hostBuilder.GetSetting(ServerPath) ?? Environment.GetEnvironmentVariable($"ASPNETCORE_{ServerPath}");
            var pairingToken = hostBuilder.GetSetting(PairingToken) ?? Environment.GetEnvironmentVariable($"ASPNETCORE_{PairingToken}");
            var iisAuth = hostBuilder.GetSetting(IISAuth) ?? Environment.GetEnvironmentVariable($"ASPNETCORE_{IISAuth}");
            var websocketsSupported = hostBuilder.GetSetting(IISWebSockets) ?? Environment.GetEnvironmentVariable($"ASPNETCORE_{IISWebSockets}");

            bool isWebSocketsSupported;
            if (!bool.TryParse(websocketsSupported, out isWebSocketsSupported))
            {
                // If the websocket support variable is not set, we will always fallback to assuming websockets are enabled.
                isWebSocketsSupported = (Environment.OSVersion.Version >= new Version(6, 2));
            }

            if (!string.IsNullOrEmpty(port) && !string.IsNullOrEmpty(path) && !string.IsNullOrEmpty(pairingToken))
            {
                // Set flag to prevent double service configuration
                hostBuilder.UseSetting(nameof(UseIISIntegration), true.ToString());

                var enableAuth = false;
                if (string.IsNullOrEmpty(iisAuth))
                {
                    // back compat with older ANCM versions
                    enableAuth = true;
                }
                else
                {
                    // Lightup a new ANCM variable that tells us if auth is enabled.
                    foreach (var authType in iisAuth.Split(new[] { ';' }, StringSplitOptions.RemoveEmptyEntries))
                    {
                        if (!string.Equals(authType, "anonymous", StringComparison.OrdinalIgnoreCase))
                        {
                            enableAuth = true;
                            break;
                        }
                    }
                }

                var address = "http://127.0.0.1:" + port;
                hostBuilder.CaptureStartupErrors(true);
                hostBuilder.ConfigureServices(services =>
                {
                    // Delay register the url so users don't accidentally overwrite it.
                    hostBuilder.UseSetting(WebHostDefaults.ServerUrlsKey, address);
                    hostBuilder.PreferHostingUrls(true);
                    services.AddSingleton<IServerIntegratedAuth>(_ => new ServerIntegratedAuth()
                    {
                        IsEnabled = enableAuth,
                        AuthenticationScheme = IISDefaults.AuthenticationScheme
                    });
                    services.AddSingleton<IStartupFilter>(new IISSetupFilter(pairingToken, new PathString(path), isWebSocketsSupported));
                    services.Configure<ForwardedHeadersOptions>(options =>
                    {
                        options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
                    });
                    services.Configure<IISOptions>(options =>
                    {
                        options.ForwardWindowsAuthentication = enableAuth;
                    });
                    services.AddAuthenticationCore();
                });
            }
            return hostBuilder;
        }
    }
}