What is Kestrel, and why might an ASP.NET Core application run behind IIS, Nginx, a cloud ingress, or another reverse proxy?

Kestrel and reverse proxy responsibilities in ASP.NET Core

Separates the ASP.NET Core HTTP server from proxy, TLS, load-balancing, process-management, and forwarded-header responsibilities.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Kestrel is ASP.NET Core's default cross-platform HTTP server. It listens for connections, parses HTTP, creates the request features exposed through HttpContext, and sends the application response. Kestrel can be exposed directly as an Internet-facing edge server, or it can run behind a reverse proxy; both are supported designs. A reverse proxy such as IIS, Nginx, YARP, or a cloud ingress can own the public address, TLS termination, host and path routing, load balancing, connection policies, and integration with platform process management. It then forwards requests to the application. I choose the topology from deployment needs rather than claiming that Kestrel is inherently unsafe without a proxy.

Full answer below

Practice focus

ASP.NET Core hosting, Kestrel, edge hosting, reverse proxies, TLS termination, process management, load balancing, host filtering, and forwarded headers.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Hosting questions reveal whether someone understands where an ASP.NET Core process ends and the network platform begins. Kestrel and a reverse proxy can both handle HTTP, but they do not have identical ownership.
Kestrel is ASP.NET Core's default cross-platform HTTP server. It listens for connections, parses HTTP, creates the request features exposed through HttpContext, and sends the application response. Kestrel can be exposed directly as an Internet-facing edge server, or it can run behind a reverse proxy; both are supported designs. A reverse proxy such as IIS, Nginx, YARP, or a cloud ingress can own the public address, TLS termination, host and path routing, load balancing, connection policies, and integration with platform process management. It then forwards requests to the application. I choose the topology from deployment needs rather than claiming that Kestrel is inherently unsafe without a proxy.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Saying Kestrel can never be safely exposed directly.
Trusting forwarded headers from any caller.
Assuming IIS always proxies to a separate Kestrel process.
Configuring conflicting timeout or request-size limits without ownership.

What is Kestrel, and why might an ASP.NET Core application run behind IIS, Nginx, a cloud ingress, or another reverse proxy?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Next interviewer turn

Go deeper

Skill areas

Suggest an improvement