dotnet / dotnet/aspnetcore

Rebalance Kestrel's Known headers collection

Open
#31,492 12 comments 0 reactions 0 assignees View on GitHub
area-networking design-proposal feature-kestrel
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

Related to (#31374) @halter73 @benaadams @davidfowl

Kestrel has a fancy KnownHeaders collection for efficient handling of common request and response headers.
https://github.com/dotnet/aspnetcore/blob/bc1ff6a45949c3debc483aae93abd0dfdf97bec1/src/Servers/Kestrel/shared/KnownHeaders.cs#L16-L31

These lists have grown organically and should be revisited. We don't want to add too many entries since it makes the types consume more memory, but we do want to ensure most common headers are represented so we can avoid the slow path.

I've compared the current lists with headers customers have reported seeing in production. Here are some of the discrepancies:

| Seen in the wild: | Kestrel: | Notes |
|-|-|-|
| | Allow | ~~Defined in commonHeaders, but only applies to responses? https://tools.ietf.org/html/rfc7231#section-7.4.1~~ |
| | Authorization | |
| | Baggage | |
| authority | | |
| bypass | | |
| cacheresponse | | |
| Client-IP | | |
| clientip | | |
| | Content-Encoding | ~~Defined in commonHeaders, but mainly used on responses~~ |
| | Content-Language | ~~Defined in commonHeaders, but mainly used on responses~~ |
| | Content-Location | ~~Defined in commonHeaders, but mainly used on responses~~ |
| | Content-MD5 | ~~Defined in commonHeaders, but mainly used on responses~~ |
| | Content-Range | ~~Defined in commonHeaders, but only applies to responses? https://tools.ietf.org/html/rfc7233#section-4.2~~ |
| ContentType | | |
| E2EActivity | | |
| el_auth_param | | |
| | Expires | |
| Forwarded | | https://tools.ietf.org/html/rfc7239 |
| forwarded-for | | |
| gb-branch | | |
| gb-no-cache | | |
| guzzle-retry | | |
| | From | Uncommon |
| | Grpc-Accept-Encoding | |
| | Grpc-Encoding | |
| | Grpc-Timeout | |
| http_accept_language | | |
| | If-Match | |
| | If-Modified-Since | |
| | If-None-Match | |
| | If-Range | |
| | If-Unmodified-Since | |
| | Keep-Alive | |
| | Last-Modified | ~~Defined in commonHeaders, but mainly used on responses~~ |
| LatencyPerfCounterName | | |
| Lcid | | |
| newrelic | | |
| OData-MaxVersion | | |
| OData-Version | | |
| okversion | | |
| postman-token | | |
| | Proxy-Authorization | Kestrel rarely acts as a forward proxy |
| Prefer | | https://tools.ietf.org/html/rfc7240 |
| Proxy-Connection | | |
| proxy-tool | | |
| Request-Context | | |
| Save-Data | | |
| sec-ch-ua | | https://wicg.github.io/ua-client-hints/ |
| Sec-Ch-Ua-Mobile | | |
| Sec-Fetch-Dest | | https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-mode-header |
| Sec-Fetch-Mode | | |
| Sec-Fetch-Site | | |
| sec-fetch-user | | |
| sec-gpc | | https://globalprivacycontrol.github.io/gpc-spec/ |
| Sec-GPC | | |
| sentry-trace | | |
| Soapaction | | |
| ssodisabled | | |
| Surrogate-Capability | | |
| transaction-id | | |
| | Trailer | ~~Defined in commonHeaders, but mainly used on responses~~ |
| | Translate | |
| | Upgrade | |
| unique-id | | |
| | Warning | |
| X_CHAN | | |
| X_GLS | | |
| X_grg | | |
| X_sn | | |
| X_ts | | |
| X-ARR-LOG-ID | | |
| X-ARR-SSL | | |
| x-country-code | | |
| x-dt-no-cache | | |
| x-finder-tools | | |
| X-Forwarded-For | | |
| x-im-piez | | |
| X-IMForwards | | |
| X-IWS-Via | | |
| x-lgi-host | | |
| x-no-varnish | | |
| X-Original-URL | | |
| x-originating-ip | | |
| x-p2p-peerdist | | |
| x-p2p-peerdistex | | |
| X-ProxyUser-IP | | |
| x-remote-addr | | |
| x-remote-ip | | |
| X-Requested-With | | |
| x-serverselect | | |
| X-Trace | | |
| Xxpect | | |

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.