IIS Deployment

Learning objectives#

• Prepare a Windows server with IIS and ASP.NET 4.8
• Publish the project with release settings
• Use Web.config transforms for environment settings
• Configure the app pool, HTTPS binding and database access

Explanation#

On the server, enable IIS with ASP.NET 4.8 (Server Manager → Web Server (IIS) → Application Development → ASP.NET 4.8). Install URL Rewrite and Dynamic Compression if you use them.

Publish from Visual Studio (Publish → Folder or Web Deploy) or from the command line with MSBuild. The output contains bin\, Global.asax and the transformed Web.config — no .cs files.

Web.config transforms (Web.Release.config) replace values at publish time: connection strings, app settings, debug="false". Keep real secrets out of Git by applying them on the build server or the server itself.

Create an application pool: .NET CLR Version v4.0, Managed Pipeline Integrated. Each API gets its own pool (and identity, IIS APPPOOL\ShopApi) so a crash or recycle affects only that app.

Create the site (or an application under an existing site), bind HTTPS with a certificate, and give the app pool identity read access to the folder and write access to App_Data if needed.

For SQL Server with Integrated Security, create a login for the app pool identity (or a domain service account) with least privilege.

Syntax#

1# Build and publish to a folder (Developer Command Prompt for VS)
2msbuild ShopApi.csproj /p:Configuration=Release /p:DeployOnBuild=true /p:PublishProfile=FolderProfile
3

4# On the server: create the app pool and site with appcmd
5%windir%\system32\inetsrv\appcmd add apppool /name:ShopApi /managedRuntimeVersion:v4.0 /managedPipelineMode:Integrated
6%windir%\system32\inetsrv\appcmd add site /name:ShopApi /physicalPath:D:\sites\ShopApi /bindings:https/*:443:api.shop.com
7%windir%\system32\inetsrv\appcmd set app "ShopApi/" /applicationPool:ShopApi

Code example: Web.Release.config — production values applied at publish#

1<?xml version="1.0" encoding="utf-8"?>
2<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
3

4  <connectionStrings>
5    <add name="ShopDb"
6         connectionString="Server=sql-prod01;Database=Shop;Integrated Security=True;"
7         xdt:Transform="SetAttributes" xdt:Locator="Match(name)" />
8  </connectionStrings>
9

10  <appSettings>
11    <add key="Cors:Origins" value="https://shop.example.com"
12         xdt:Transform="SetAttributes" xdt:Locator="Match(key)" />
13    <add key="Environment" value="Production"
14         xdt:Transform="SetAttributes" xdt:Locator="Match(key)" />
15  </appSettings>
16

17  <system.web>
18    <compilation xdt:Transform="RemoveAttributes(debug)" />
19  </system.web>
20

21</configuration>

When publishing in Release, Visual Studio/MSBuild merges this file into Web.config: the ShopDb connection string points to sql-prod01, CORS allows only the production site, Environment becomes Production, and debug="true" is removed so IIS compiles optimised code and hides debug output.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

1. xdt:Locator="Match(name)" finds the connection string with the same name in Web.config.
2. xdt:Transform="SetAttributes" replaces only the attributes listed (connectionString, value).
3. RemoveAttributes(debug) turns off debug compilation in production.
4. appcmd creates an isolated application pool and an HTTPS site pointing at the published folder.
5. The pool identity IIS APPPOOL\ShopApi is what SQL Server sees with Integrated Security.

Real-world use case#

Common mistakes#

Best practices#

• One application pool per API
• Publish Release builds only, with transforms
• HTTPS binding with a valid certificate
• Least-privilege identities for files and SQL

Remember this#

Practice exercise#

1<?xml version="1.0" encoding="utf-8"?>
2<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
3  <connectionStrings>
4    <add name="ShopDb" connectionString="Server=sql-staging;Database=Shop;Integrated Security=True;"
5         xdt:Transform="SetAttributes" xdt:Locator="Match(name)" />
6  </connectionStrings>
7  <appSettings>
8    <add key="Environment" value="Staging" xdt:Transform="SetAttributes" xdt:Locator="Match(key)" />
9  </appSettings>
10</configuration>

Mini quiz#

Want more? Practise all ASP.NET Web API MCQs · ASP.NET Web API interview questions

Related topics#

My notes#

Saved in this browser.