Microsoft IIS as a Backend - HTTP/HTTPS Bindings

Key Takeaways

you know guys I have discussed many web servers in this channel but I have failed to discuss one of the most popular web servers that I have personally used for a longest time and that web server is called IIs Microsoft Internet Information Services how about we take a few moments to discuss this beautiful beautiful Observer that is to me in my opinion it's a little bit underrated let's just jump into it welcome to the back and Engineering show with your host Hussein Nasser and IIs I don't remember when was the first time I actually used i h could have been maybe eight or 10 years ago um but I come from a Windows environment right so I the first computer I used is was Windows I recently switched to Mac maybe five years ago so H and I in in my daily job uh my 95 we exclusively work on Windows most of the time I interact with products that Microsoft offer things like IIs which is installed by default it is absolutely frictionless to get a web server in Windows you just literally go to features and then enable that thing IIs voila you have op server you take your HTML file you copy it into c pop ww root there you go you just serve your W server you have you have a static website if you want to build asp.net if you have Visual Studio I've built many asp.net applications and ASP the older versions as well and you can just drop these files and compile them into your I and all of a sudden you have them running so IIs is feature Rich it has so many features and me being St starting with IIs as a web server in my opinion which is this is what I did I started with I and Apachi I didn't work with aachi as much as iOS to be honest but starting with that beautiful web server H kind of had some negative connotation on my knowledge let me explain because this web server hides so many abstractions it hases so many abstractions from you as a developer that you start you start getting comfortable using the SW server without knowing how much work it does and to me that's a slippery slope for an engineer the moment you start to interacting with a technology that you are responsible for let's be be very specific to that and you take it for granted then if something goes wrong you don't really know what's going on anymore you're just at the mercy of this black box and this is something I talked about in my channel it's called leaky abstractions right and and uh I think Joel sposi uh invented this term leaky abstraction which is this IIs or this web server hides as much complexity from you as possible and when it does that the it is inevitable that some of this complexity will leak back to you in form in in a form of a performance problem in a form of unknown errors which we got a lot in IIs like what is this kind of error right what is this oh headers already sent these kind of Errors when oh my God these kind of days I remember so when you don't understand how things work and you take this black book and it works this is when things get really dangerous in my opinion that's why in my opinion you really have to understand the fundamentals of things and IIs gave me this bad habit of taking web servers for granted I didn't really know that it was actually a web server it was just hey this is the thing that actually does this thing you copy and then just host it how I don't know I don't care bad so when I started moving my stack building actually like uh nodejs app from scratch actually listening is spinning up an HTTP server and seeing the work I want back in iOS was like oh my God I really appreciate how much work Microsoft did to build this complex server but now you can sneak into the advaned section and see the knobs the knobs that you can do in this beautiful Observer so much stuff and I'd like to take maybe uh one section of this and then just talk through just that portion maybe I'll make more videos to talk more about I if you'd like if you enjoy this kind of content to make a is hit that like button give me a comment more IIs videos please and I'll make sure if if there is enough interest I might continue doing that I might even do it anyway if I find interest in that I I definitely find these features very interesting so let's start with the concept of bindings here a binding is um the in you create an IIs that corresponds to a an address and a port you listen on this port and you specify the protocol for this binding so for example you can create an HTTP binding on Port 80 I guess it is also created to you by default and you can create as many HTTP bindings as you want for a given website and a website is is really this this this logical thing in IIs that points to a directory so you create a new website and you say oh where is the directory where all this HTML and JavaScript stuff with once you created this directory creates a website and then you create bindings to link this uh to this directory effectively there's permissions and stuff like that too so now when you go to Local Host 80 uh content will be served from this directory effectively you can create another binding that points to the same directory right and you can create another binding that points you can have many many ports pointing to the same directory so another type of binding is called https binding and htps binding is is the secure version of HTTP and the moment you say that right uh I I I've seen this dialogue so many times that I actually seen it evolve in in different Windows versions the first version was literally just a box that says host name in it it was like what what host name is this really right and the certificate obviously because if you create an htps binding that means this is a secure web server that means you have to enable TLS that means the server need to serve back to the client its certificate so you need to provide the certificate for the server okay so that parameter makes sense another parameter is the host name what is the host name that we're actually connecting to so what what are we returning to the user here right what host name will be accepted in a request in this particular case and there is another checkbox that they also recently added uh it's called require server name indication and I clearly remember maybe four years ago or three years ago when I saw the first time I saw this book it's like what the heck is a server name indication so I started learning reading that's that led to creating of many many videos to talk about server uh server name indication which is very related it's a TLS extension I talked about that check it out here if you want to learn more about it and that's when I started diving deep into these uh the realm of TLS and and making more videos about it so server and communication so this is the TLs extension that allows you to have a TLS session and during the handshake you ask exactly what host name do you really want so you're connected to the same IP address right one connection might request site a another connection might request site B and the server name indication right will tell you which site you actually want so which content you actually want despite both sides are served on the same IP address this is this is to support scaling web servers otherwise it's going to be so expensive right you cannot have a web server in a unique IP address anymore especially in ipv4 IPv6 maybe we're going to figure this out eventually but until now we're going to share so one single IP address can host many websites so there's another checkbox they literally I believe if I'm not mistaken they added maybe this into 2018 or 2017 uh I might be wrong there it's called disable http2 it says clearly disable http2 that indicates that it it is enabled by default http2 is enabled by default and they give you an option to disable it Microsoft or any companies for that matter they don't they don't really add features for the ad for the for the sake of adding features right so probably when htb2 here's what I think happened when htb2 came in everybody says htv2 is better than htv1 let's enable it by default they did that they regretted it so fast because a lot of people start complaining that the CPU usage with htb2 went shot up high because of reasons I talked about right here right so Microsoft added this checkbox to disable hdp2 that's my guess okay another option is disable OS ocsp stapling which is stands for online certificate status protocol this is to uh this is to indicate if a certificate is valid or not so this is another thing I talked about right here part of the certificate so another thing that you can actually disable all right guys I'm going to make this video short and sweet and I might I might make another video discussing the pooling the connection pools and application pool so much cool things in this web server I'm going to see you on the next one you guys stay awesome goodbye