Microsoft.AspNetCore.Server.Kestrel.Core

An exception thrown when a malformed http request has been received.

Feature for efficiently handling connection timeouts.

Close the connection after the specified positive finite unless the timeout is canceled or reset. This will fail if there is an ongoing timeout.

Close the connection after the specified positive finite unless the timeout is canceled or reset. This will cancel any ongoing timeouts.

Prevent the connection from closing after a timeout specified by or .

A connection feature allowing middleware to stop counting connections towards . This is used by Kestrel internally to stop counting upgraded connections towards this limit.

Idempotent method to stop counting a connection towards .

The stream id for a given stream in an HTTP/2 connection.

Gets the id for the HTTP/2 stream.

Feature to set the minimum data rate at which the the request body must be sent by the client. This feature is not supported for HTTP/2 requests except to disable it entirely by setting to Instead, use for server-wide configuration which applies to both HTTP/2 and HTTP/1.x.

The minimum data rate in bytes/second at which the request body must be sent by the client. Setting this property to null indicates no minimum data rate should be enforced. This limit has no effect on upgraded connections which are always unlimited. This feature is not supported for HTTP/2 requests except to disable it entirely by setting to Instead, use for server-wide configuration which applies to both HTTP/2 and HTTP/1.x.

Feature to set the minimum data rate at which the response must be received by the client. This feature is not available for HTTP/2 requests. Instead, use for server-wide configuration which applies to both HTTP/2 and HTTP/1.x.

The minimum data rate in bytes/second at which the response must be received by the client. Setting this property to null indicates no minimum data rate should be enforced. This limit has no effect on upgraded connections which are always unlimited. This feature is not available for HTTP/2 requests. Instead, use for server-wide configuration which applies to both HTTP/2 and HTTP/1.x.

Feature to set access the TLS application protocol

Gets the represeting the application protocol.

Limits only applicable to HTTP/2 connections.

Limits the number of concurrent request streams per HTTP/2 connection. Excess streams will be refused. Value must be greater than 0, defaults to 100.

Limits the size of the header compression tables, in octets, the HPACK encoder and decoder on the server can use. Value must be greater than or equal to 0, defaults to 4096.

Indicates the size of the largest frame payload that is allowed to be received, in octets. The size must be between 2^14 and 2^24-1. Value must be between 2^14 and 2^24, defaults to 2^14 (16,384).

Indicates the size of the maximum allowed size of a request header field sequence. This limit applies to both name and value sequences in their compressed and uncompressed representations. Value must be greater than 0, defaults to 2^14 (16,384).

Indicates how much request body data the server is willing to receive and buffer at a time aggregated across all requests (streams) per connection. Note requests are also limited by Value must be greater than or equal to 65,535 and less than 2^31, defaults to 128 kb.

Indicates how much request body data the server is willing to receive and buffer at a time per stream. Note connections are also limited by Value must be greater than or equal to 65,535 and less than 2^31, defaults to 96 kb.

Gets or sets the keep alive ping delay. The server will send a keep alive ping to the client if it doesn't receive any frames on a connection for this period of time. This property is used together with to close broken connections. Delay value must be greater than or equal to 1 second. Set to to disable the keep alive ping. Defaults to .

Gets or sets the keep alive ping timeout. Keep alive pings are sent when a period of inactivity exceeds the configured value. The server will close the connection if it doesn't receive any frames within the timeout. Timeout must be greater than or equal to 1 second. Set to to disable the keep alive ping timeout. Defaults to 20 seconds.

Limits only applicable to HTTP/3 connections.

Limits the size of the header compression table, in octets, the QPACK decoder on the server can use. Value must be greater than 0, defaults to 0.

HTTP protocol versions

Returns an for the given host an port. If the host parameter isn't "localhost" or an IP address, use IPAddress.Any.

A with a back pointer to the pool it came from. Dispose will return it to the pool.

Provider returns multiple awaitables. Awaitables are completed FIFO.

Provider has a single awaitable.

Begin encoding headers in the first HEADERS frame.

Continue encoding headers in the next HEADERS frame. The enumerator should already have a current value.

The core logic for the IValueTaskSource implementation.

Used to kick off the request processing loop by derived classes.

SETTINGS_MAX_FIELD_SECTION_SIZE, default is unlimited. https://quicwg.org/base-drafts/draft-ietf-quic-qpack.html#section-5

Used to kick off the request processing loop by derived classes.

The stream ID is set by QUIC.

Used to track the timeout in two situations: 1. Between when the stream was started by the client, and getting a header. Value is driven by . 2. Between when the request delegate is complete and the transport draining. Value is driven by .

The stream is receiving the header frame. - Request streams = HEADERS frame. - Control streams = unidirectional stream header.

The stream request delegate is complete and the transport is draining.

Manages the generation of the date header value.

Returns a value representing the current server date/time for use in the HTTP "Date" response header in accordance with http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.18

The value in string and byte[] format.

Sets date values from a provided ticks value

A DateTimeOffset value

http://tools.ietf.org/html/rfc2616#section-3.6.1

Immediately kill the connection and poison the request body stream with an error.

Stops the request processing loop between requests. Called on all active connections when the server wants to initiate a shutdown and after a keep-alive timeout.

Holds a byte[] from the pool and a size value. Basically a Memory but guaranteed to be backed by an ArrayPool byte[], so that we know we can return it.

The upgrade stream uses the raw connection stream instead of going through the RequestBodyPipe. This removes the redundant copy from the transport pipe to the body pipe.

The request id.

Default HttpRequest PipeReader implementation to be used by Kestrel.

Connections that have been switched to a different protocol.

The endpoint Kestrel will bind to if nothing else is specified.

The endpoint Kestrel will bind to if nothing else is specified and a default certificate is available.

Prefix of host name used to specify Unix sockets in the configuration.

Prefix of host name used to specify pipe file descriptor in the configuration.

Prefix of host name used to specify socket descriptor in the configuration.

Summary description for Disposable

Checks that up to 8 bytes from correspond to a known HTTP method.

A "known HTTP method" can be an HTTP method name defined in the HTTP/1.1 RFC. Since all of those fit in at most 8 bytes, they can be optimally looked up by reading those bytes as a long. Once in that format, it can be checked against the known method. The Known Methods (CONNECT, DELETE, GET, HEAD, PATCH, POST, PUT, OPTIONS, TRACE) are all less than 8 bytes and will be compared with the required space. A mask is used if the Known method is less than 8 bytes. To optimize performance the GET method will be checked first. true if the input matches a known string, false otherwise.

Parses string for a known HTTP method.

A "known HTTP method" can be an HTTP method name defined in the HTTP/1.1 RFC. The Known Methods (CONNECT, DELETE, GET, HEAD, PATCH, POST, PUT, OPTIONS, TRACE)

Checks 9 bytes from correspond to a known HTTP version.

A "known HTTP version" Is is either HTTP/1.0 or HTTP/1.1. Since those fit in 8 bytes, they can be optimally looked up by reading those bytes as a long. Once in that format, it can be checked against the known versions. The Known versions will be checked with the required '\r'. To optimize performance the HTTP/1.1 will be checked first. true if the input matches a known string, false otherwise.

Checks 8 bytes from correspond to a known HTTP version.

A "known HTTP version" Is is either HTTP/1.0 or HTTP/1.1. Since those fit in 8 bytes, they can be optimally looked up by reading those bytes as a long. Once in that format, it can be checked against the known versions. To optimize performance the HTTP/1.1 will be checked first. the HTTP version if the input matches a known string, Unknown otherwise.

Checks 8 bytes from that correspond to 'http://' or 'https://'

The span A reference to the known scheme, if the input matches any True when memory starts with known http or https schema

Defines an interface that represents a listener bound to a specific .

The endpoint that was bound. This may differ from the requested endpoint, such as when the caller requested that any free port be selected.

Stops listening for incoming connections.

The token to monitor for cancellation requests. A that represents the unbind operation.

Defines an interface that represents a listener bound to a specific .

Begins an asynchronous operation to accept an incoming connection.

The token to monitor for cancellation requests. A that completes when a connection is accepted, yielding the representing the connection.

Abstracts the system clock to facilitate testing.

Retrieves the current UTC system time.

Retrieves ticks for the current UTC system time.

Retrieves the current UTC system time. This is only safe to use from code called by the .

Wraps a PipeWriter so you can start appending more data to the pipe prior to the previous flush completing.

This wraps PipeWriter.FlushAsync() in a way that allows multiple awaiters making it safe to call from publicly exposed Stream implementations while also tracking response data rate.

Provides access to the normal system clock.

Retrieves the current UTC system time.

Retrieves ticks for the current UTC system time.

Retrieves the current UTC system time.

Given a DWORD which represents a buffer of 4 bytes, widens the buffer into 4 WORDs and compares them to the WORD buffer with machine endianness.

Given a WORD which represents a buffer of 2 bytes, widens the buffer into 2 WORDs and compares them to the WORD buffer with machine endianness.

Returns iff all bytes in are ASCII.

A faster version of String.Concat(, , .ToString("X8"))

Wrap the initial . ConnectionContext's returned from ConnectAsync and AcceptAsync will then be wrapped.

Wraps transport with .

A helper for wrapping a Stream decorator from an .

Computes a minimum segment size

Kestrel server.

Initializes a new instance of .

The Kestrel . The . The .

Gets the .

Limits for .

Gets or sets the maximum size of the response buffer before write calls begin to block or return tasks that don't complete until the buffer size drops below the configured limit. Defaults to 65,536 bytes (64 KB).

When set to null, the size of the response buffer is unlimited. When set to zero, all write calls will block or return tasks that don't complete until the entire response buffer is flushed.

Gets or sets the maximum size of the request buffer. Defaults to 1,048,576 bytes (1 MB).

When set to null, the size of the request buffer is unlimited.

Gets or sets the maximum allowed size for the HTTP request line. Defaults to 8,192 bytes (8 KB).

For HTTP/2 and HTTP/3 this measures the total size of the required pseudo headers :method, :scheme, :authority, and :path.

Gets or sets the maximum allowed size for the HTTP request headers. Defaults to 32,768 bytes (32 KB).

Gets or sets the maximum allowed number of headers per HTTP request. Defaults to 100.

Gets or sets the maximum allowed size of any request body in bytes. When set to null, the maximum request body size is unlimited. This limit has no effect on upgraded connections which are always unlimited. This can be overridden per-request via . Defaults to 30,000,000 bytes, which is approximately 28.6MB.

Gets or sets the keep-alive timeout. Defaults to 130 seconds.

Gets or sets the maximum amount of time the server will spend receiving request headers. Defaults to 30 seconds.

Gets or sets the maximum number of open connections. When set to null, the number of connections is unlimited. Defaults to null.

When a connection is upgraded to another protocol, such as WebSockets, its connection is counted against the limit instead of .

Gets or sets the maximum number of open, upgraded connections. When set to null, the number of upgraded connections is unlimited. An upgraded connection is one that has been switched from HTTP to another protocol, such as WebSockets. Defaults to null.

When a connection is upgraded to another protocol, such as WebSockets, its connection is counted against the limit instead of .

Limits only applicable to HTTP/2 connections.

Limits only applicable to HTTP/3 connections.

Gets or sets the request body minimum data rate in bytes/second. Setting this property to null indicates no minimum data rate should be enforced. This limit has no effect on upgraded connections which are always unlimited. This can be overridden per-request via . Defaults to 240 bytes/second with a 5 second grace period.

Gets or sets the response minimum data rate in bytes/second. Setting this property to null indicates no minimum data rate should be enforced. This limit has no effect on upgraded connections which are always unlimited. This can be overridden per-request via . Defaults to 240 bytes/second with a 5 second grace period.

Contrary to the request body minimum data rate, this rate applies to the response status line and headers as well. This rate is enforced per write operation instead of being averaged over the life of the response. Whenever the server writes a chunk of data, a timer is set to the maximum of the grace period set in this property or the length of the write in bytes divided by the data rate (i.e. the maximum amount of time that write should take to complete with the specified data rate). The connection is aborted if the write has not completed by the time that timer expires.

Provides programmatic configuration of Kestrel-specific features.

Gets or sets whether the Server header should be included in each response.

Defaults to true.

Gets or sets a value that controls whether dynamic compression of response headers is allowed. For more information about the security considerations of HPack dynamic header compression, visit https://tools.ietf.org/html/rfc7541#section-7.

Defaults to true.

Gets or sets a value that controls whether synchronous IO is allowed for the and

Defaults to false.

Gets or sets a value that controls how the `:scheme` field for HTTP/2 and HTTP/3 requests is validated. If false then the `:scheme` field for HTTP/2 and HTTP/3 requests must exactly match the transport (e.g. https for TLS connections, http for non-TLS). If true then the `:scheme` field for HTTP/2 and HTTP/3 requests can be set to alternate values and this will be reflected by `HttpRequest.Scheme`. The Scheme must still be valid according to https://datatracker.ietf.org/doc/html/rfc3986/#section-3.1. Only enable this when working with a trusted proxy. This can be used in scenarios such as proxies converting from alternate protocols. See https://datatracker.ietf.org/doc/html/rfc7540#section-8.1.2.3. Applications that enable this should validate an expected scheme is provided before using it.

Defaults to false.

Gets or sets a value that controls whether the string values materialized will be reused across requests; if they match, or if the strings will always be reallocated.

Defaults to false.

Controls whether to return the "Alt-Svc" header from an HTTP/2 or lower response for HTTP/3.

Defaults to false.

Gets or sets a callback that returns the to decode the value for the specified request header name, or to use the default .

Gets or sets a callback that returns the to encode the value for the specified response header or trailer name, or to use the default .

Enables the Listen options callback to resolve and use services registered by the application during startup. Typically initialized by UseKestrel().

Provides access to request limit options.

Provides a configuration source where endpoints will be loaded from on server start. The default is .

A default configuration action for all endpoints. Use for Listen, configuration, the default url, and URLs.

A default configuration action for all https endpoints.

The default server certificate for https endpoints. This is applied lazily after HttpsDefaults and user options.

Has the default dev certificate load been attempted?

Specifies a configuration Action to run for each newly created endpoint. Calling this again will replace the prior action.

Specifies a configuration Action to run for each newly created https endpoint. Calling this again will replace the prior action.

Creates a configuration loader for setting up Kestrel.

A for configuring endpoints.

Creates a configuration loader for setting up Kestrel that takes an as input. This configuration must be scoped to the configuration section for Kestrel. Call to enable dynamic endpoint binding updates.

The configuration section for Kestrel. A for further endpoint configuration.

Creates a configuration loader for setting up Kestrel that takes an as input. This configuration must be scoped to the configuration section for Kestrel.

The configuration section for Kestrel. If , Kestrel will dynamically update endpoint bindings when configuration changes. This will only reload endpoints defined in the "Endpoints" section of your . Endpoints defined in code will not be reloaded. A for further endpoint configuration.

Bind to given IP address and port.

Bind to given IP address and port. The callback configures endpoint-specific settings.

Bind to the given IP endpoint.

Bind to the given endpoint.

Bind to given IP address and port. The callback configures endpoint-specific settings.

Bind to the given endpoint. The callback configures endpoint-specific settings.

Listens on ::1 and 127.0.0.1 with the given port. Requesting a dynamic port by specifying 0 is not supported for this type of endpoint.

Listens on all IPs using IPv6 [::], or IPv4 0.0.0.0 if IPv6 is not supported.

Bind to given Unix domain socket path.

Bind to given Unix domain socket path. Specify callback to configure endpoint-specific settings.

Open a socket file descriptor.

Open a socket file descriptor. The callback configures endpoint-specific settings.

Describes either an , Unix domain socket path, or a file descriptor for an already open socket that Kestrel should bind to or open.

Gets the .

The to bind to. Only set if the is .

The absolute path to a Unix domain socket to bind to. Only set if the is .

A file descriptor for the socket to open. Only set if the is .

Enables connection middleware to resolve and use services registered by the application during startup. Only set if accessed from the callback of a Listen* method.

The protocols enabled on this endpoint.

Defaults to HTTP/1.x and HTTP/2.

Gets or sets a value that controls whether the "Alt-Svc" header is included with response headers. The "Alt-Svc" header is used by clients to upgrade HTTP/1.1 and HTTP/2 connections to HTTP/3. The "Alt-Svc" header is automatically included with a response if has either HTTP/1.1 or HTTP/2 enabled, and HTTP/3 is enabled. If an "Alt-Svc" header value has already been set by the app then it isn't changed.

Defaults to false.

Gets the application .

Gets the name of this endpoint to display on command-line when the web server starts.

Adds a middleware delegate to the connection pipeline. Configured by the UseHttps() and extension methods.

The middleware delegate. The .

Builds the .

The .

Gets the name of this endpoint to display on command-line when the web server starts.

The minimum data rate for incoming connections.

Creates a new instance of .

The minimum rate in bytes/second at which data should be processed. The amount of time to delay enforcement of , starting at the time data is first read or written.

The minimum rate in bytes/second at which data should be processed.

The amount of time to delay enforcement of , starting at the time data is first read or written.

Bad request.

Bad chunk size data.

Bad chunk suffix.

Chunked request incomplete.

The message body length cannot be determined because the final transfer coding was set to '{detail}' instead of 'chunked'.

Request headers too long.

Invalid characters in header name.

Invalid content length: {detail}

Invalid Host header.

Invalid Host header: '{detail}'

Invalid request headers: missing final CRLF in header fields.

Invalid request header: '{detail}'

Invalid request line.

Invalid request line: '{detail}'

Invalid request target: '{detail}'

{detail} request contains no Content-Length header.

Malformed request: invalid headers.

Method not allowed.

Request is missing Host header.

Multiple Content-Length headers.

Multiple Host headers.

Request line too long.

Reading the request headers timed out.

Request contains too many headers.

Unexpected end of request content.

Unrecognized HTTP version: '{detail}'

Failed to bind to http://[::]:{port} (IPv6Any). Attempting to bind to http://0.0.0.0:{port} instead.

Cannot write to response body after connection has been upgraded.

Kestrel does not support big-endian architectures.

Maximum request buffer size ({requestBufferSize}) must be greater than or equal to maximum request header size ({requestHeaderSize}).

Maximum request buffer size ({requestBufferSize}) must be greater than or equal to maximum request line size ({requestLineSize}).

Server has already started.

Unknown transport mode: '{mode}'.

Invalid non-ASCII or control character in header: {character}

Invalid Content-Length: "{value}". Value must be a positive integral number.

Value must be null or a non-negative number.

Value must be a non-negative number.

Value must be a positive number.

Value must be null or a positive number.

Unix socket path must be absolute.

Failed to bind to address {address}.

No listening endpoints were configured. Binding to {address} by default.

A path base can only be configured using {methodName}.

Dynamic port binding is not supported when binding to localhost. You must either bind to 127.0.0.1:0 or [::1]:0, or both.

Failed to bind to address {endpoint}: address already in use.

Unable to bind to {address} on the {interfaceName} interface: '{error}'.

Overriding address(es) '{addresses}'. Binding to endpoints defined via IConfiguration and/or UseKestrel() instead.

Overriding endpoints defined via IConfiguration and/or UseKestrel() because {settingName} is set to true. Binding to address(es) '{addresses}' instead.

Unrecognized scheme in server address '{address}'. Only 'http://' and 'https://' are supported.

Headers are read-only, response has already started.

An item with the same key has already been added.

Setting the header {name} is not allowed on responses with status code {statusCode}.

{name} cannot be set because the response has already started.

Response Content-Length mismatch: too few bytes written ({written} of {expected}).

Response Content-Length mismatch: too many bytes written ({written} of {expected}).

The response has been aborted due to an unhandled application exception.

Writing to the response body is invalid for responses with status code {statusCode}.

Connection shutdown abnormally.

Connection processing ended abnormally.

Cannot upgrade a non-upgradable request. Check IHttpUpgradeFeature.IsUpgradableRequest to determine if a request can be upgraded.

Request cannot be upgraded because the server has already opened the maximum number of upgraded connections.

IHttpUpgradeFeature.UpgradeAsync was already called and can only be called once per connection.

Request body too large. The max request body size is {maxRequestBodySize} bytes.

The maximum request body size cannot be modified after the app has already started reading from the request body.

The maximum request body size cannot be modified after the request has been upgraded.

Value must be a positive TimeSpan.

The request body rate enforcement grace period must be greater than {heartbeatInterval} second.

Synchronous operations are disallowed. Call ReadAsync or set AllowSynchronousIO to true instead.

Synchronous operations are disallowed. Call WriteAsync or set AllowSynchronousIO to true instead.

Value must be a positive number. To disable a minimum data rate, use null where a MinDataRate instance is expected.

Concurrent timeouts are not supported.

Timespan must be positive and finite.

An endpoint must be configured to serve at least one protocol.

HTTP/2 over TLS was not negotiated on an HTTP/2-only endpoint.

The client sent a {frameType} frame with even stream ID {streamId}.

The client sent a A PUSH_PROMISE frame.

The client sent a {frameType} frame to stream ID {streamId} before signaling of the header block for stream ID {headersStreamId}.

The client sent a {frameType} frame with stream ID 0.

The client sent a {frameType} frame with stream ID different than 0.

The client sent a {frameType} frame with padding longer than or with the same length as the sent data.

The client sent a {frameType} frame to closed stream ID {streamId}.

The client sent a {frameType} frame to stream ID {streamId} which is in the "half-closed (remote) state".

The client sent a {frameType} frame with dependency information that would cause stream ID {streamId} to depend on itself.

The client sent a {frameType} frame with length different than {expectedLength}.

The client sent a SETTINGS frame with a length that is not a multiple of 6.

The client sent a SETTINGS frame with ACK set and length different than 0.

The client sent a SETTINGS frame with a value for parameter {parameter} that is out of range.

The client sent a WINDOW_UPDATE frame with a window size increment of 0.

The client sent a CONTINUATION frame not preceded by a HEADERS frame.

The client sent a {frameType} frame to idle stream ID {streamId}.

The client sent trailers containing one or more pseudo-header fields.

The client sent a header with uppercase characters in its name.

The client sent a trailer with uppercase characters in its name.

The client sent a HEADERS frame containing trailers without setting the END_STREAM flag.

Request headers missing one or more mandatory pseudo-header fields.

Pseudo-header field found in request headers after regular header fields.

Request headers contain unknown pseudo-header field.

Request headers contain response-specific pseudo-header field.

Request headers contain duplicate pseudo-header field.

Request headers contain connection-specific header field.

Certificate {thumbprint} cannot be used as an SSL server certificate. It has an Extended Key Usage extension but the usages do not include Server Authentication (OID 1.3.6.1.5.5.7.3.1).

The server certificate parameter is required.

No listening endpoints were configured. Binding to {address0} and {address1} by default.

The requested certificate {subject} could not be found in {storeLocation}/{storeName} with AllowInvalid setting: {allowInvalid}.

The endpoint {endpointName} is missing the required 'Url' parameter.

Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date. To generate a developer certificate run 'dotnet dev-certs https'. To trust the certificate (Windows and mac ...

The endpoint {endpointName} specified multiple certificate sources.

Cannot write to the response body, the response has completed.

Reading the request body timed out due to data arriving too slowly. See MinRequestBodyDataRate.

The connection was aborted by the application.

The connection was aborted because the server is shutting down and request processing didn't complete within the time specified by HostOptions.ShutdownTimeout.

The connection was timed out by the server because the response was not read by the client at the specified minimum data rate.

The connection was timed out by the server.

The received frame size of {size} exceeds the limit {limit}.

Tls 1.2 or later must be used for HTTP/2. {protocol} was negotiated.

Invalid HTTP/2 connection preface.

Header name cannot be a null or empty string.

The connection or stream was aborted because a write operation was aborted with a CancellationToken.

The client sent a SETTINGS frame with a SETTINGS_INITIAL_WINDOW_SIZE that caused a flow-control window to exceed the maximum size.

The client sent a WINDOW_UPDATE frame that caused a flow-control window to exceed the maximum size.

The HTTP/2 connection faulted.

The client reset the request stream.

The request stream was aborted.

The client sent more data than what was available in the flow-control window.

CONNECT requests must not send :scheme or :path headers.

The Method '{method}' is invalid.

The request :path is invalid: '{path}'

The request :scheme header '{requestScheme}' does not match the transport scheme '{transportScheme}'.

Less data received than specified in the Content-Length header.

More data received than specified in the Content-Length header.

An error occurred after the response headers were sent, a reset is being sent.

A new stream was refused because this connection has reached its stream limit.

CONNECT requests must not send :scheme or :path headers.

The request :scheme header '{requestScheme}' does not match the transport scheme '{transportScheme}'.

The Method '{method}' is invalid.

The request :path is invalid: '{path}'

Less data received than specified in the Content-Length header.

More data received than specified in the Content-Length header.

A value greater than zero is required.

A value between {min} and {max} is required.

The client closed the connection.

A frame of type {frameType} was received after stream {streamId} was reset or aborted.

This feature is not supported for HTTP/2 and HTTP/3 requests except to disable it entirely by setting the rate to null.

The request trailers are not available yet. They may not be available until the full request body is read.

HTTP/2 over TLS is not supported on macOS due to missing ALPN support.

The HTTP/2 stream was reset by the application with error code {errorCode}.

A new stream was refused because this connection has too many streams that haven't finished processing. This may happen if many streams are aborted but not yet cleaned up.

Detected a TLS handshake to an endpoint that does not have TLS enabled.

The ASP.NET Core developer certificate is in an invalid state. To fix this issue, run the following commands 'dotnet dev-certs https --clean' and 'dotnet dev-certs https' to remove all existing ASP.NET Core development certificates and create a new untrust ...

Index {index} is outside the bounds of the header field table.

The decoded integer exceeds the maximum value of Int32.MaxValue.

Huffman decoding error.

Decoded string length of {length} octets is greater than the configured maximum length of {maxStringLength} octets.

Quic transport not found when using HTTP/3.

Unable to resolve service for type 'Microsoft.AspNetCore.Connections.IConnectionListenerFactory' while attempting to activate 'Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer'.

A value greater than or equal to zero is required.

HTTP/2 over TLS is not supported on Windows versions earlier than Windows 10 and Windows Server 2016 due to incompatible ciphers or missing ALPN support.

Timeout while waiting for incoming HTTP/2 frames after a keep alive ping.

A TimeSpan value greater than or equal to {value} is required.

The provided key file is missing or invalid.

Unknown algorithm for certificate with public key type '{0}'.

Connection refused because no SNI configuration section was found for '{serverName}' in '{endpointName}'. To allow all connections, add a wildcard ('*') SNI section.

Connection refused because the client did not specify a server name, and no wildcard ('*') SNI configuration section was found in '{endpointName}'.

The endpoint {endpointName} is invalid because an SNI configuration section has an empty string as its key. Use a wildcard ('*') SNI section to match all server names.

The non-HTTPS endpoint {endpointName} includes HTTPS-only configuration for {keyName}.

The HTTP/3 connection faulted.

The HTTP/3 request stream was aborted.

The HTTP/3 stream was reset by the application with error code {errorCode}.

An error occurred after the response headers were sent, a reset is being sent.

The client sent a DATA frame to a request stream before the HEADERS frame.

The client sent a {frameType} frame after trailing HEADERS.

The client sent a {frameType} frame to a request stream which isn't supported.

The client sent a {frameType} frame to the server which isn't supported.

The client sent a {frameType} frame to a control stream which isn't supported.

The client sent a SETTINGS frame to a control stream that already has settings.

The client sent a {frameType} frame to a control stream before the SETTINGS frame.

The client sent a reserved setting identifier: {identifier}

The client created multiple inbound {streamType} streams for the connection.

Request stream ended without headers.

Reading the control stream header timed out.

The client closed the connection control stream inbound to the server.

Stream type {type} is unsupported.

Error initializing outbound control stream.

Enables loading TLS certificates from the certificate store.

Loads a certificate from the certificate store.

Exact subject match is loaded if present, otherwise best matching certificate with the subject name that contains supplied subject. Subject comparison is case-insensitive. The certificate subject. The certificate store name. The certificate store location. Whether or not to load certificates that are considered invalid. The loaded certificate.

Describes the client certificate requirements for a HTTPS connection.

A client certificate is not required and will not be requested from clients.

A client certificate will be requested; however, authentication will not fail if a certificate is not provided by the client.

A client certificate will be requested, and the client must provide a valid certificate for authentication to succeed.

A client certificate is not required and will not be requested from clients at the start of the connection. It may be requested by the application later.

Settings for how Kestrel should handle HTTPS connections.

Initializes a new instance of .

Specifies the server certificate used to authenticate HTTPS connections. This is ignored if ServerCertificateSelector is set. If the server certificate has an Extended Key Usage extension, the usages must include Server Authentication (OID 1.3.6.1.5.5.7.3.1).

A callback that will be invoked to dynamically select a server certificate. This is higher priority than ServerCertificate. If SNI is not available then the name parameter will be null. The will be null for HTTP/3 connections. If the server certificate has an Extended Key Usage extension, the usages must include Server Authentication (OID 1.3.6.1.5.5.7.3.1).

Specifies the client certificate requirements for a HTTPS connection. Defaults to .

Specifies a callback for additional client certificate validation that will be invoked during authentication. This will be ignored if is called after this callback is set.

Specifies allowable SSL protocols. Defaults to which allows the operating system to choose the best protocol to use, and to block protocols that are not secure. Unless your app has a specific reason not to, you should use this default.

The protocols enabled on this endpoint.

Defaults to HTTP/1.x only.

Specifies whether the certificate revocation list is checked during authentication.

Overrides the current callback and allows any client certificate.

Provides direct configuration of the on a per-connection basis. This is called after all of the other settings have already been applied.

Specifies the maximum amount of time allowed for the TLS/SSL handshake. This must be positive or . Defaults to 10 seconds.

Per connection state used to determine the TLS options.

The TLS stream on which the authentication happens.

Information from the Client Hello message.

The information that was passed when registering the callback.

The token to monitor for cancellation requests.

Information about an individual connection.

Indicates if the application is allowed to request a client certificate after the handshake has completed. The default is false. See

Options used to configure a per connection callback for TLS configuration.

The callback to invoke per connection. This property is required.

Optional application state to flow to the callback.

Specifies the maximum amount of time allowed for the TLS/SSL handshake. This must be positive or . Defaults to 10 seconds.

The configuration for an endpoint.

Gets whether the endpoint uses HTTPS.

Gets the endpoint .

Gets the .

Gets the for the endpoint.

Configuration loader for Kestrel.

Gets the .

Gets the application .

If , Kestrel will dynamically update endpoint bindings when configuration changes. This will only reload endpoints defined in the "Endpoints" section of your Kestrel configuration. Endpoints defined in code will not be reloaded.

Specifies a configuration Action to run when an endpoint with the given name is loaded from configuration.

Bind to given IP address and port.

Bind to given IP endpoint.

Bind to given IP address and port.

Listens on ::1 and 127.0.0.1 with the given port. Requesting a dynamic port by specifying 0 is not supported for this type of endpoint.

Listens on all IPs using IPv6 [::], or IPv4 0.0.0.0 if IPv6 is not supported.

Bind to given Unix domain socket path.

Open a socket file descriptor.

Loads the configuration.

The client sent a {frameType} frame with length different than {expectedLength}.

The received frame size of {size} exceeds the limit {limit}.

Extension methods for that configure Kestrel to use HTTPS for a given endpoint.

Configure Kestrel to use HTTPS with the default certificate if available. This will throw if no default certificate is configured.

The to configure. The .