Docs for UseForwardedHeaders, working with reverse proxies and load balancers

[Tratcher]

https://docs.microsoft.com/en-us/aspnet/core/publishing/linuxproduction
aspnet/Security#1070
aspnet/Security#929
aspnet/Security#757
aspnet/Security#853
aspnet/IISIntegration#140
aspnet/Security#1620
aspnet/Security#1702
Enabled by default by UseIISIntegration, but with limited settings (ANCM reverse proxy on loopback)

[Tratcher]

aspnet/BasicMiddleware#190

[Rick-Anderson]

@Tratcher Please clarify the ask and outline the solution.

[Tratcher]

Most sites are hosted behind a reverse proxy, especially our recommended configurations using IIS/ANCM or NGinx. When the request is being proxied some information may be lost like the original scheme (http/https), the client IP address, etc.. You may need these values to properly generate links, evaluate polices, geolocate clients, etc.. There is a convention for the proxies to forward these values as HTTP headers (x-forwarded-*). The UseForwardedHeaders middleware reads these headers and fills in the associated fields on HttpContext.

UseForwardedHeaders has pretty complicated settings due to trust concerns with these forwarded headers (e.g. spoofing). Explain how the middleware works overall and each of the settings.

UseForwardedHeaders is enabled by default by UseIISIntegration, but with a very restricted configuration specific to ANCM.

[spboyer]

@Tratcher if UseIISIntegration is not enabled and/or IIS is not used (i.e. nginx, apache, etc) it is important to not only have the reverse proxy setup properly for forwarding the requests and headers, but to also add the UseForwardedHeaders middleware.

Is that what you are asking here to document?

and is more that the following needed:

            app.UseForwardedHeaders(new ForwardedHeadersOptions
            {
                ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
            });

[Tratcher]

@spboyer yes that's part of it. There are several other settings related to identifying/trusting the proxies. You also need to make sure your reverse proxy is adding the headers.

[Tratcher]

https://docs.microsoft.com/en-us/aspnet/core/publishing/linuxproduction captures the nginx specific scenario.

[spboyer]

@Tratcher so are you looking for a specific document targeted at just the setting for UseForwardedHeaders?

UseForwardedHeaders has pretty complicated settings due to trust concerns with these forwarded headers (e.g. spoofing). Explain how the middleware works overall and each of the settings.

[Tratcher]

Not quite. We need to explain the end-to-end scenarios and how the various UseForwardedHeaders settings apply (e.g. IIS+ANCM, Nginx, multiple proxies, etc.).