Kestrel, the host and Program.cs

How the app starts: configuration, service registration and the server beginning to listen.

UnderstandStudy an examplePractise

Understand the concept

An ASP.NET Core app is set up in Program.cs in two phases. First the builder phase: configuration sources (appsettings.json, environment variables, user secrets) are read and services are registered in the dependency injection container. Then builder.Build() creates the app and the middleware pipeline is declared in order. With app.Run() Kestrel starts listening.

Kestrel is ASP.NET Core’s built-in, cross-platform HTTP server. It turns incoming bytes into HTTP requests, creates an HttpContext per request and hands it to the start of the pipeline. It can face the internet directly but in production usually runs behind a reverse proxy.

Configuration is layered: a later source overrides an earlier one. That is how the development connection string in appsettings.json is replaced in production by the ConnectionStrings__Portfolio environment variable. Secrets never go into code or the repository; this project uses user secrets in development and environment variables in production.

WHEN TO USE IT

Knowing how the app starts makes configuration and environment bugs easier to solve.

COMMON PITFALL

Writing the production connection string or JWT key into appsettings.json and committing it.

01 / PRACTICE

One topic. Three levels of depth.

Illustrative example

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllers();
var app = builder.Build();
app.MapControllers();
app.Run();

The smallest working API: register services, build, map endpoints, listen.

This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.

02 / YOUR TURN

Try it yourself first.

The app runs locally but on the server fails with ‘Jwt:Key not found’. Locally the value is in user secrets. What is missing on the server?

Show the solution and explanation

Worked solution

user-secrets yalnız Development ortamında ve yalnız o kullanıcı profilinde okunur.
Sunucuya ortam değişkeni eklenmeli: Jwt__Key=<değer>

User secrets are not a production mechanism; production must supply the value from another source.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.