I would like to ask if it is save to publish .net core web project to production IIS server directly through WebDeploy or Folder publish profile.
What about already running http requests ? Would it be better to stop the IIS website first, update codes and start website again ? But I don't know if stopping the IIS website will wait for running http requests or stops them by force. Does the publish profile handle this by default (for example it happens often with folder publish profile that files are being in use by IIS process and the publish operation fails) ?
What is your publishing process, do you stop the website instance ?
The configuration file will be saved when directly publishing the .net core project to IIS.
When publishing a .net core application, the web is not running in iis, but as a separate out-of-process console application, using Kestrel components. AspNetCoreModule is hooked to the IIS pipeline early in the request cycle, redirects all traffic to the following Core application, and all requests are forwarded to the Core process.
Requests come in from the Web and int the kernel mode http.sys driver which routes into IIS on the primary port (80) or SSL port (443). The request is then forwarded to your ASP.NET Core application on the HTTP port configured for your application which is not port 80/443. In essence, IIS acts a reverse proxy simply forwarding requests to your ASP.NET Core Web running the Kestrel Web server on a different port.
So I suggest you stop the website while publishing and restart it then. Files in the deployment folder are locked when the app is running. Locked files can't be overwritten during deployment. I recommend that you take the original application offline when you publish a new web, which is also recommended by Microsoft. More details can refer to following documents。