Web API self host - bind on all network interfaces

Question

How do you make a Web API self host bind on all network interfaces?

I have the below code currently. Unfortunately, it binds only on localhost. So access to this server from other than localhost is failing.

var baseAddress = string.Format("http://localhost:9000/"); 
            using (WebApp.Start<Startup> (baseAddress)) 
            {
                Console.WriteLine("Server started");
                Thread.Sleep(1000000);
            }

Ciapha

Answer 1

Just change the base address like this

        var baseAddress = "http://*:9000/"; 
        using (WebApp.Start<Startup> (baseAddress)) 
        {
            Console.WriteLine("Server started");
            Thread.Sleep(1000000);
        }

And it should bind correctlly to all interfaces.

Tannate

I've seem people using http://+:9000/. What's the difference between + and *? @mauriciod73 – Perlite

Run visual studio as admin if you get Target Invocation Exception and "Access is denied" – Sadick

"What's the difference between + and *?" see UrlPrefix Strings. '+' is the strong wildcard, '*' the weak wildcard. Strong here just means that the host name on an incoming request is tested against this binding first, whereas the weak binding ('*') is applied after any other bindings, such as those specifying an explicit host name. So you can set up the bindings to serve different resources depending on the incoming URL, and the '*' binding picks up anything that wasn't explicitly bound to. – Bloemfontein

Thanks stackoverflow.com/users/171846/fidel !!!. Running as Admin was my problem. – Lentissimo

It was really helpfull answer! My self hosted app stopped work after 2 month and it was intsalled in MS Windows Server 2008 R2. It was always with localhost:9000. I could not figured out what is the reason but hopefully I found this answer! Thank you so much! – Guillory

Wildcard bindings are not advised. To quote: "Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create app security vulnerabilities. This applies to both strong and weak wildcards. Use explicit host names or IP addresses rather than wildcards. Subdomain wildcard binding (for example, *.mysub.com) isn't a security risk if you control the entire parent domain (as opposed to *.com, which is vulnerable)." learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/… – Boyle

Why 0.0.0.0 (IPAddress.Any) not working in this case ? – Suck

Answer 2

If you get access exceptions, please DO NOT start Visual Studio as admin user. Add an URL reservation instead. The following example assumes that you want to open port 9000 as HTTP service on all ports & hostnames (http://+:9000/) without any user restriction.

Start a command console window as administrator and execute:

netsh
netsh> http add urlacl url="http://+:9000/" sddl=D:(A;;GX;;;S-1-1-0)

The SDDL translates to "all users" from your current domain / machine.

Modify your code accordingly:

var baseAddress = "http://+:9000/";
using (WebApp.Start<Startup> (baseAddress)) 
{
  // your code here
}

You can delete the reservation by running:

netsh
netsh> http delete urlacl url="http://+:9000/"

However, Microsoft recommends to avoid Top-level wildcard bindings, see:

• https://learn.microsoft.com/en-us/windows/win32/http/add-urlacl

For more information about the difference between http://*:9000/ and http://+:9000/ see:

• What does a plus sign mean in a http url? -> http://+:80

Jedediah

How do I remove this? After doing this I can't use string baseAddress = "localhost:9000"; anymore... – Dilworth