Notes from the team running your stack.
Tech insights, deep dives, and announcements for developers and ops teams on .NET, Windows Server, SQL Server, ASP.NET Core, and the wider web platform.
-
Don't Bake Environment Into the .NET Publish Zip
Green Web Deploys still boot against staging SQL when environment was baked into the zip. Bind ASPNETCORE_ENVIRONMENT on IIS and keep one Release artifact.
-
Separate Liveness From Database Readiness
Load balancer probes that open SQL on every hit will starve the pool under recycle storms. Split liveness from readiness before the next deploy.
-
HostOptions.ShutdownTimeout Is Only Five Seconds
ASP.NET Core gives hosted services five seconds to stop unless you raise HostOptions.ShutdownTimeout. On IIS app pool recycles that default truncates queue drains and leaves half-finished SQL work.
-
Keep Host Config Intact When Publishing .NET 10
Blind Web Deploy overwrites connection strings and rewrite rules on shared IIS. Separate code from host config with skip rules, layered appsettings, and a short post-publish check.
-
Kestrel Body Limits Still Hit IIS 404.13
Raising MaxRequestBodySize is not enough behind IIS. Align requestFiltering or large POSTs still die as 404.13 before Kestrel runs.
-
Web Deploy Parameters and Post-Publish Smoke Tests
Most IIS outages after a .NET ship are bad config, not bad code. Parameterize Web Deploy, keep secrets off disk, and gate traffic on a short smoke script.
-
Put Forwarded Headers First in the ASP.NET Pipeline
IIS already terminated TLS, yet apps still log http and 127.0.0.1. Run UseForwardedHeaders before HTTPS redirects and auth or scheme and client IP stay wrong.
-
SqlClient Encrypt Defaults Break Quietly After NuGet Bumps
A Microsoft.Data.SqlClient bump can flip Encrypt on and drop SQL connections from IIS overnight. Here is the failure mode we see and how to set Encrypt on purpose.
-
Ship .NET 10 With Staging Slots, Not Blind Overwrites
Stop overwriting production first. Use a publish-once pipeline, environment slots, and post-deploy smoke checks that fit shared IIS and Windows VPS reality.
-
Stop Regenerating Data Protection Keys on Every Recycle
App pool recycles that wipe in-memory Data Protection keys log everyone out. Persist the key ring outside the publish folder so cookies and antiforgery survive IIS restarts.
-
Folder Swap Cutover for .NET 10 on IIS
Shared and VPS IIS hosts rarely offer Azure-style slots. Publish to a sibling folder, smoke-test it, then flip the site physical path for a clean cutover.
-
Parameter Sniffing Fixes for ASP.NET SQL Workloads
One cached plan can make the same ASP.NET query fly or crawl. Spot parameter sniffing on SQL Server and fix it without blanket recompiles.
-
Output Cache for ASP.NET Core 10 APIs on IIS
Cut repeat SQL and CPU on IIS-hosted APIs with ASP.NET Core output cache. Wire policies, vary-by rules, and tag eviction so responses stay fast and correct after recycles.
-
Harden ASP.NET Core Auth Cookies on IIS
Lock down cookie authentication for ASP.NET Core 10 on IIS: Secure, HttpOnly, SameSite, names, and lifetimes. Concrete CookieOptions and hosting notes you can ship.
-
ANCM In-Process vs Out-of-Process on IIS
Choose the right AspNetCoreModuleV2 hosting model for .NET 10 on IIS. In-process wins on latency; out-of-process wins on isolation—here is how to set both.