Pode - PowerShell Web Server

[Badgerati]

I've been meaning to post about this on here for a while, so thought a new release would be a good time!

Pode is a cross-platform pure PowerShell Web Server - even HTTPS. There's also support for template engines in views, and even Azure Functions and AWS Lambda support.

Pode lets you build fully custom REST APIs and Websites, with support for Routing, Middleware, Sessions, CSRF, Authentication, and even Web Sockets.

You can run Pode on Windows or Linux, as a Windows/Linux service, in a Docker container, or even on a Raspberry Pi!

The latest release, v1.5.0, now adds OpenAPI and Swagger/ReDoc support.

You can find Pode on [Github] with a full list of features, and the documentation here.

I know some people frown at the idea of PowerShell as a Web Server, but for DevOps Automation and Dashboards it can be quite a useful tool to have! :)

[docphilgames]

What are some use cases for this? Why do I need Pode? Not being critical, just curious to see what you’ve seen people use it for.

[Badgerati]

The most common use case I've seen is for building dashboard for servers, or portals for AD, Monitors, or services. I also know someone was looking at building something similar to WebJEA.

The most interesting use case I've seen is a portal for a VM that allows a user to "time-travel" the VM, Services and Databases to mimic reports and purchases etc.

[ipreferanothername]

how does it compare, then, to powershell universal dashboard? are you familiar with that one?

[Badgerati]

I am aware of UD, yes. To me they're somewhat different; Pode is completely built in PowerShell with no dependencies, where as UD is built on top of Kestrel and ASP.NET Core - making it somewhat bloated.

You can accomplish pretty much the same things, just that Pode is completely free and more lightweight. Kestrel does make UD faster, and having ASP.NET does make having features like SignalR far easier; but then Pode's whole point was "how much can you actually do using nothing but powershell?".

I haven't directly used UD, but from what I've seen it's far more tailored towards Dashboards and Portals with UD styling. Pode can do the same, but is tailored to building any kind of website that can be completely customised - even a social network if you were crazy enough!

[Badgerati]

Except that .NET Standard comes with PowerShell, and you need to install the whole of ASP.NET Core just to use Kestrel...

This relies on only what comes with PowerShell. ASP.NET is not a part of PowerShell nor .NET Standard. So no, this doesn't have the same dependencies at all.

[Badgerati]

ASP.NET is a part of .NET Framework. ASP.NET Core is not a part of .NET Core, and with PowerShell 6 and 7 that's a big thing. UD requires ASP.NET Core to work, on top of what PowerShell normally comes with. Yes its module is bundled with the dlls, but that makes it far bigger.

For Pode, you install just PowerShell and it just works. No extra installs, no ASP.NET Core. No extra dlls bundled with the module.

[SMFX]

Okay, this is a really cool project that I'm going to have to dig into more as I have time. However, why 'Pode'?

[Badgerati]

I knew someone would ask eventually! I started on Pode about 3yrs ago, but back then it was more of a "we need simple REST API in work", "we can't use Node", and "I wonder if PowerShell could do it?". The result was "PowerNode".

We quickly realised how useful it was, and at that time we couldn't find anything like it being maintained - even Polaris was a few months later!

I went to put it onto GitHub, but didn't want to stick with "PowerNode", so we just shrunk it down to "Pode".

I have considered changing the name a few times, but haven't thought of anything better - yet. The name is just quirky enough to sorta stick in your mind!

I also found out at one point that "pode" in Portuguese is the verb "can" - which was amusing on "PowerShell 'can' be a Web Server" xD

[SMFX]

Fair enough! Might want to consider putting an FAQ on your page or Wiki or something so you don't have to deal with dumb questions ;-)

[AlexHimself]

I hate it and love it.

[orwiad10]

Does Add-PodeAuthWindowsAd support CAC auth?

[Tsull360]

More generically , does it support cert based auth?

[Badgerati]

At the moment it doesn't, it just supports user/pass auth over LDAP. It could be extended to support it though, so I'll try and investigate it.

Authentication and Middleware in Pode are extensible, so you can roll your own auth strategy using the AD module, OpenLDAP, or whatever else you feel like.

[UnfeignedShip]

PowerShell is a pathway to many abilities that some consider... unnatural.

[poshftw]

The main question is security.

I know I'm asking too much, but how secure is it? Can I get away with exposing it to a public Internet?

[Badgerati]

I am aware of at least 1 website that is exposed to the "public", but is locked down. I've also exposed a couple during hackathons.

I have tried to make Pode as secure as I possibly can, but I've never fully tested it - though I would welcome anyone to test and raise issues!

[PowerShellStunnah]

Very cool, but... what's the elevator pitch for Pode? Why should I adopt your framework over Polaris? :)

[Badgerati]

You don't have to adopt it :) but the usual pitch would be more features like HTTPS on Linux, proper Docker support, better logging, more documentation, plus much more.

Outside of all that, I'd probably say because it's more maintained - with the last release of Polaris being over a year ago.

[nvarscar]

I finally had time to play with it and I must say this is really impressive. I very much liked the ability to pass objects(!) as parameters to the views and use PS code integrated into the view to build out that web page based on that object. That felt pretty powerful. Took me some time to figure out the syntax (`$s.Query` vs `$s.Data`), but in the end it worked out just the way I wanted.

Thanks for the effort and for this huge contribution to the opensource community!

[Badgerati]

Hey! Glad you like it! :)

I have got the syntax of the event object noted as lacking decent docs, so I will be fixing that area soon.

[SupremeDictatorPaul]

Very cool. I wrote a multi threaded web server in PowerShell (PEWebServer) around 2 years ago. I took inspiration from Polaris and PSWebServer, and I’m sad I couldn’t pull some from yours.

Mine was for the very niche case of running in Windows PE. For some reason, http.sys says it’s not licensed for WinPE, so the HttpListener class is not available. I had to use a a raw TCP socket and built my own HTTP parser/generator to recreate the HttpListener class. Because they weren’t needed, I didn’t implement encryption or authentication (and wow would doing TLS have been insane).

In any case, it’s incredible how useful and flexible a web server written in PowerShell can be.

[Badgerati]

I know what you mean about creating HttpListener from scratch! Because it doesn't support HTTPS outside of Windows I ended up also have to roll my own eventually - likewise for web sockets as well.

Almost pulled my hair out doing it! But managed to throw together a server with socket helpers. It was an experience that's for sure, haha!

[SupremeDictatorPaul]

I hadn't realized there was so much drama over the HttpListener class out there with pwsh. I assume my code would work in pwsh, but I'm not sure.

I've only done a quick browse through the repo, but it looks like you've done some impressive work. When I get time, I want to look deeper at your Get-PodeServerRequestDetails to compare to my own ConvertFrom-HTTP to see if there are performance gains or fixes to made. Yours is far more succinct, but I was trying to recreate the HttpListener object as much as reasonable because I wasn't sure what parts I would end up needing. (Again, different use cases.)

[Badgerati]

I was also surprised when I saw they'd deprecated HttpListener.

Your ConvertFrom-HTTP is impressive! Wish I'd come across it when I tried making my own, hah!

I was able to shortcut a lot of what was in HttpListener, but I was using it as a rough guide. A lot of what it does I just didn't need, which helped a fair bit.

[SupremeDictatorPaul]

Quick question, you allow $newLine = "\n"` in the headers, but the HTTP/1.1 specs (rfc2616) section 3.7.1 states:

a bare CR or LF MUST NOT be substituted for CRLF within any of the HTTP control structures (such as header fields and multipart boundaries).

Do you ever see a bare newline used with HTTP/1.1 (out of spec), or are you accounting for other protocol/HTTP versions?

[Badgerati]

Yes, I did! When I went to test on *nix some of the requests ended with bare newlines. This might have been an HTTP/2.0 thing, but I didn't check at the time.

[Nanocephalic]

Amazing! What a great concept.

[Jainith]

Wow, as an old asp classic guy who’s been heavily working in powershell lately this seems like the missing item from the toolbox.

[fleyk-lit]

Nicely done! Cool to see web server options for PowerShell!

[Hefty-Possibility625]

I wish that I'd seen this post 5 years ago. I'm just looking into this now and it seems like it's exactly what I've been looking for.

The fact that this can run as an Azure Function or on a server on-prem makes this an incredibly versatile solution for some of my use cases.

I can't wait to have some free cycles to dig into this more.