33

How do you make a Web API self host bind on all network interfaces?

I have the below code currently. Unfortunately, it binds only on localhost. So access to this server from other than localhost is failing.

var baseAddress = string.Format("http://localhost:9000/"); 
            using (WebApp.Start<Startup> (baseAddress)) 
            {
                Console.WriteLine("Server started");
                Thread.Sleep(1000000);
            }
Phill
  • 18,398
  • 7
  • 62
  • 102
govin
  • 6,445
  • 5
  • 43
  • 56

2 Answers2

46

Just change the base address like this

        var baseAddress = "http://*:9000/"; 
        using (WebApp.Start<Startup> (baseAddress)) 
        {
            Console.WriteLine("Server started");
            Thread.Sleep(1000000);
        }

And it should bind correctlly to all interfaces.

robertfriberg
  • 161
  • 10
evilpilaf
  • 1,991
  • 2
  • 21
  • 38
  • 9
    I've seem people using http://+:9000/. What's the difference between + and *? @mauriciod73 – regisbsb Jun 02 '15 at 11:09
  • 10
    Run visual studio as admin if you get Target Invocation Exception and "Access is denied" – Fidel Aug 02 '15 at 17:21
  • 21
    "What's the difference between + and \*?" see [UrlPrefix Strings](https://msdn.microsoft.com/en-us/library/aa364698(v=vs.85).aspx). '+' is the strong wildcard, '*' the weak wildcard. Strong here just means that the host name on an incoming request is tested against this binding first, whereas the weak binding ('\*') is applied after any other bindings, such as those specifying an explicit host name. So you can set up the bindings to serve different resources depending on the incoming URL, and the '\*' binding picks up anything that wasn't explicitly bound to. – redcalx Aug 12 '15 at 08:42
  • 1
    Thanks http://stackoverflow.com/users/171846/fidel !!!. Running as Admin was my problem. – SilentNot Jan 09 '17 at 19:05
  • It was really helpfull answer! My self hosted app stopped work after 2 month and it was intsalled in MS Windows Server 2008 R2. It was always with http://localhost:9000/. I could not figured out what is the reason but hopefully I found this answer! Thank you so much! – NoWar Sep 19 '17 at 04:25
  • 1
    Wildcard bindings are not advised. To quote: _"Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create app security vulnerabilities. This applies to both strong and weak wildcards. Use explicit host names or IP addresses rather than wildcards. Subdomain wildcard binding (for example, *.mysub.com) isn't a security risk if you control the entire parent domain (as opposed to *.com, which is vulnerable)."_ https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/httpsys?view=aspnetcore-3.1 – tjmoore Jan 10 '20 at 13:39
  • Why `0.0.0.0` (`IPAddress.Any`) not working in this case ? – apdevelop Aug 02 '20 at 10:26
12

If you get access exceptions, please DO NOT start Visual Studio as admin user. Add an URL reservation instead. The following example assumes that you want to open port 9000 as HTTP service on all ports & hostnames (http://+:9000/) without any user restriction.

Start a command console window as administrator and execute:

netsh
netsh> http add urlacl url="http://+:9000/" sddl=D:(A;;GX;;;S-1-1-0)

The SDDL translates to "all users" from your current domain / machine.

Modify your code accordingly:

var baseAddress = "http://+:9000/";
using (WebApp.Start<Startup> (baseAddress)) 
{
  // your code here
}

You can delete the reservation by running:

netsh
netsh> http delete urlacl url="http://+:9000/"

However, Microsoft recommends to avoid Top-level wildcard bindings, see:

For more information about the difference between http://*:9000/ and http://+:9000/ see:

Daniel Müller
  • 434
  • 4
  • 12
  • How do I remove this? After doing this I can't use string baseAddress = "http://localhost:9000/"; anymore... – eri0o May 26 '20 at 19:03