{"id":95404,"date":"2019-06-20T15:00:19","date_gmt":"2019-06-20T15:00:19","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/aspnet\/?p=22256"},"modified":"2019-06-20T15:00:19","modified_gmt":"2019-06-20T15:00:19","slug":"forwarded-headers-middleware-updates-in-net-core-3-0-preview-6","status":"publish","type":"post","link":"https:\/\/sickgaming.net\/blog\/2019\/06\/20\/forwarded-headers-middleware-updates-in-net-core-3-0-preview-6\/","title":{"rendered":"Forwarded Headers Middleware Updates in .NET Core 3.0 preview 6"},"content":{"rendered":"
\n
\n
\"Avatar\"<\/div>\n<\/div>\n<\/div>\n
\n

June 20th, 2019<\/p>\n<\/p><\/div>\n

<\/p>\n

With the ASP.NET Core 2.1 release, we included UseHsts<\/code> and UseHttpRedirection<\/code> by default. These methods put a site into an infinite loop if deployed to an Azure Linux App Service, Azure Linux virtual machine (VM), or behind any other reverse proxy besides IIS. TLS is terminated by the reverse proxy, and Kestrel isn\u2019t made aware of the correct request scheme.<\/p>\n

OAuth and OIDC also fail in this configuration because they generate incorrect redirects. Calls to UseIISIntegration<\/code> add and configure forwarded headers middleware when running behind IIS, but there\u2019s no matching automatic configuration for Linux (Apache or Nginx integration). The fix for this issue is discussed in more detail in the doc article Forward the scheme for Linux and non-IIS reverse proxies<\/a>.<\/p>\n

Configuration-only Wire-up in Preview 6<\/h2>\n

With the updates in .NET Core 3 preview 6, you no longer need to call the middleware explicitly, as the host logic has been pre-wired to enable the Forwarded Headers Middleware by default as long as the ASPNETCORE_FORWARDEDHEADERS_ENABLED<\/code> environment variable has been set to true<\/code>. Turning on the Forwarded Headers Middleware is as simple as setting the ASPNETCORE_FORWARDEDHEADERS_ENABLED<\/code> setting in the Azure Portal\u2019s configuration blade for any App Service running on Linux or in a container.<\/p>\n

\"Enabling<\/p>\n

Once this setting is set to true, the middleware starts working, and features dependent on Request.IsHttps<\/code> resulting to true<\/code> begin to function as expected.<\/p>\n

Resolving the issue with ASP.NET Core 2.x Apps Today<\/h2>\n

If you\u2019re currently building an ASP.NET Core 2.x app and want to run it on App Service for Linux now, there\u2019s a workaround that will be future-proof when the updates come out for 3.0.<\/p>\n

To forward the scheme from the proxy in non-IIS scenarios, add and configure Forwarded Headers Middleware. In Startup.cs<\/code>, use the following code:<\/p>\n

\/\/ using Microsoft.AspNetCore.HttpOverrides; public void ConfigureServices(IServiceCollection services)\n{ if (string.Equals( Environment.GetEnvironmentVariable(\"ASPNETCORE_FORWARDEDHEADERS_ENABLED\"), \"true\", StringComparison.OrdinalIgnoreCase)) { services.Configure<forwardedheadersoptions>(options => { options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto; \/\/ Only loopback proxies are allowed by default. \/\/ Clear that restriction because forwarders are enabled by explicit \/\/ configuration. options.KnownNetworks.Clear(); options.KnownProxies.Clear(); }); }\n} public void Configure(IApplicationBuilder app, IWebHostEnvironment env)\n{ app.UseForwardedHeaders();\n}\n<\/code><\/pre>\n
If you enable your ASP.NET Core 2.x apps with this workaround today, when you\u2019re ready to upgrade to 3.0, you\u2019ll already have the right configuration setting in place.<\/p>\n
Base Image Update<\/h2>\n
The base images used by the App Service team to streamline the creation of ASP.NET Core apps will soon be updated so that the ASPNETCORE_FORWARDEDHEADERS_ENABLED<\/code> environment variable will be set to true<\/code>. Once they\u2019re updated, you won\u2019t even need to explicitly set the environment variable; it\u2019ll be enabled by default.<\/p>\n
Try it Out<\/h2>\n
If you\u2019re new to building ASP.NET Core apps using containers, the App Service options for Linux and Container-based hosting offer a great place to get started. The docs are loaded with guidance and examples, from how to Run a .NET Core app in App Service on Linux<\/a> to accessing a SQL Server Database from an ASP.NET Core app running in App Service Linux<\/a>.<\/p>\n
\n
\"Avatar\"<\/div>\n
\n
 Brady Gaster<\/a><\/h5>\n
Senior Program Manager, ASP.NET Core<\/p>\n
Follow <\/strong>   <\/i><\/a><\/i><\/a><\/a><\/p>\n<\/p><\/div>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
June 20th, 2019 With the ASP.NET Core 2.1 release, we included UseHsts and UseHttpRedirection by default. These methods put a site into an infinite loop if deployed to an Azure Linux App Service, Azure Linux virtual machine (VM), or behind any other reverse proxy besides IIS. TLS is terminated by the reverse proxy, and Kestrel […]<\/p>\n","protected":false},"author":2,"featured_media":95405,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[66,1],"tags":[102],"class_list":["post-95404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-webdev","category-uncategorized","tag-uncategorized"],"_links":{"self":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/95404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/comments?post=95404"}],"version-history":[{"count":0,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/95404\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media\/95405"}],"wp:attachment":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media?parent=95404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/categories?post=95404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/tags?post=95404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}