How does IIS Express Handle running MVC Applications without having Windows 10 "Application Development Features" Installed?

Question

User-1851576699 posted

For the administrators, this is not a question exclusive to MVC applications. It's just my example case.

I've been building and debugging MVC applications on my Windows 10 version 1803 system for years using Visual Studio 2017 and it's built-in IIS Express development web server.

No problems.

Fast forward to today where I began actually publishing my application to be hosted on IIS 10.0 on the same machine. Well, it did not work "as-is". I finally figured out that I had to launch the Control Panel and "Turn Windows features on or off".

This fixed the problem. But it puzzles me as to why this is even necessary.

Are the requirements not the same for hosting an MVC application on IIS Express as they are for hosting the same on the regular IIS 10.0 Server?

Obviously not right? Since, I just learned all this the hard way today. But if anybody can fill me in on some of the gory details about why this is the case I'd like to know. 

I would have thought those required features would be "shared", so to speak, between the two different servers.

Answer 1

User409696431 posted

If you mean you have to turn certain features on to have IIS running on your local PC, that is true.  IIS is not enabled by default.  (Most Windows users will never use it.)   Obviously when you install Visual Studio, it also installs a fully functional development server, which is what you were using before.

Answer 2

User-1851576699 posted

Hi KathyW,

Thanks for your response. I think you summed it up pretty well as that's what I'm experiencing. I fully understand (and agree with you) about why the features required to run IIS 10.0 are not fully installed by default.

I guess my only surprise was (and still is), more than anything, that the functionality required by very similar applications relies on 2 different sources for their dependencies. In other words, you mentioned that Visual Studio installs a fully functional development server during it's installation. Why doesn't Visual Studio source the required features from the same place as using IIS 10.0 full server?

There is no difference in functionality of an MVC application whether it's running on IIS Express or it's bigger brother. Do you see what I'm saying? If there's no difference in the functionality of the applications your building why are the server requirements so different? Of course, I don't know how different they are behind the scenes. For all I know, maybe turning on the features for the full IIS Server simply duplicates the features already installed for IIS Express.

If anybody has more low level details, I would be interested in hearing them. Thanks.

Answer 3

User409696431 posted

"Why doesn't Visual Studio source the required features from the same place as using IIS 10.0 full server?"

Why would they?  They are distinct.   IIS Express is not IIS.  Prior versions of VS used Cassini as the development server, and that also was not IIS.

IIS is more flexible/configurable than either IIS Express or Cassini.   (Good luck trying to run classic ASP on Cassini, for example.)

Answer 4

User1120430333 posted

Fast forward to today where I began actually publishing my application to be hosted on IIS 10.0 on the same machine. Well, it did not work "as-is". I finally figured out that I had to launch the Control Panel and "Turn Windows features on or off".

Are the requirements not the same for hosting an MVC application on IIS Express as they are for hosting the same on the regular IIS 10.0 Server?

IIS Express is not an O/S component, unlike IIS. IIS Express is just a developer's tool, like the Visual Stuido Web developer file server its predecessor.   IIS is a service and/or services on the Windows O/S that are attackable and can be compromised, which are not installed and enabled by default. IIS is/are services that should be disabled and showdown to mitigate the attack vector on the Windows O/S when they are not needed.

A machine running IIS, the real Web server, from a developer's standpoint should always be behind a gateway device like a gateway computer (harden) running a network firewall, a router or a firewall appliance, which are all stand alone firewall solutions,  to protect the IIS services and many other services running on the Windows O/S.

Oh but one would say I have a personal firewall or the Windows firewall running on the machine, that should be good enough, and I don't need all that other stuff. I am as good as gold, but he or she  not realizing that anything running with the O/S can be fooled and compromised just like the O/S. 

It saddens me to see the inexperienced user, which I am by no means experienced when it comes to the hardening of the Windows O/S, file system, registry, user accounts and services like IIS to attack and stick the machine out there on the Internet. It's just hack-bait, pure and simple and can and do get used a a jumping off point to attack networks. There are 1,000 page books on this and the experts can hardly do it, let alone the complete inexperienced user doing it. :) 

Oh, I am just an inexperienced user so I am just going to stick the Windows O/S out there running a bunch of services. But hey,  it's OK, becuase ignorance is bliss. :)