New day, new challenge, 😉

A client asked me if I can make her vfp windows software work without network shares or IIS. The reason is some new security rule of her company.

If I have no more network share, I can still access the vfp tables thru HTTP (using a vfp dll running inside IIS). If I have no more IIS I can self-host ASP.NET in an EXE (or a Windows service) and call my vfp dll from there.

At least I think so. 😉

Am I right?

TIA, Markus

I would use IIS Express for this. You can install it with your app, it's small and gives you all of IIS's feature so you don't have to screw around with this in your own application or custom app. You can automate remote access via powershell install script (or with an installer) to open up the ports needed to externally access non-standard ports (ie. 80 or 443). If you need to integrate with your application, you can command line start and stop as needed.

This is basically what Web Connection does today with a development server - I have a launch() command that launches Web Connection with any of the supported Web servers (IIS, IIS Express, and the .NET Core based Web Connection Web Server).

There's a hostable WebServer core in .NET (HttpListener), but it's very low level and doesn't do ASP.NET. It's possible to hook that up via HttpRuntime but it's a lot of work and ugly. I built something like that a long time ago for Web Connection before there was IIS Express and while it worked it was neither efficient nor very stable.

HttpListener is great for low level tasks that you might otherwise use Sockets for, or for something like a simple static file Web Server that you can host inside of a FoxPro app. I still use this (w/o ASP.NET Support) in Help Builder to allow local preview of the Web site - basically a static Web Server running in a FoxPro app. If you use West Wind Client Tools the commercial version of wwDotnetBridge includes the SimpleHttpServer .NET class that can be hosted in FoxPro. It's not officially documented as I use it internally but it has the abililty to pass in a RequestHandler that fires in response to incoming requests. I wouldn't use this for anything that has any sort of volume but for a few application specific requests that need to be handled for two-communication this works great.

On a related note - Web Connection nowadays ships with a self-contained, .NET Core based Web server that allows running applications without a Web server. Every project gets its own instance of the Web server which is small and capable of running a Web Connection application locally or exposed over the network similar to the way IIS Express works, except all the Web Connection stuff is built in and 'just works'. It does require a .NET Core 5.x Runtime install though.

+++ Rick ---

Thank you very much.

I'll read a bit about the options you mentioned. Then ask the client if one of them is compliant with her new security needs.

Markus

Anything you build yourself is going to be less secure than IIS Express would be my guess...

In fact the secure thing would be to run IIS as it's meant to be used for that use case. In its default state IIS is locked down hard and you can set it up to only work for the purposes you are using it for. In fact the hard part is not securing it usually, but making it functional enough to work. The insecurity of IIS is a myth of pre-IIS7 days 😄

+++ Rick ---