Since the 1.0 release the docs, tutorials, quick starts, etc have said not to expose ASP.NET Core Kestrel based apps directly to internet traffic. Here is the

Since the 1.0 release the docs, tutorials, quick starts, etc have said not to expose ASP.NET Core Kestrel based apps directly to internet traffic. Here is the current version of the docs that mention this: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?tabs=aspnetcore1x#when-to-use-kestrel-with-a-reverse-proxy https://docs.microsoft.com/en-us/aspnet/core/fundamentals/se... The warning was repeated all over the place - you can search the web dig through the git history of the docs and see the warning to use a reverse proxy all over. They probably should have made Kestrel complain loudly if it detected it was exposed and "force" everyone to be successful, but it's only partially their fault if people ignored the documentation.