I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives to Kestrel, be it valid HTTP request or not. IIS does handle the SSL though, so it's quite transparent for Kestrel.
So I have a question: does that mean that with the exception of SSL, security is handled by Kestrel? So all potential vulnerabilities in IIS are pretty much not possible or easy to exploit? Like e.g. a bug that allowed to get the web.config some time ago from IIS would only be possible to abuse if Kestrel has the similar type of bug.