dotnet / dotnet/yarp

Support CDN-Loop header

Open
#1,110 0 comments 0 reactions 0 assignees View on GitHub
Type: Enhancement Type: Idea
Dominant language
C#
Stars
9.6k
Forks
933
Avg merge
12d 18h
Merged PRs (30d)
2

Description

[RFC8586](https://datatracker.ietf.org/doc/html/rfc8586) defines a header CDN-Loop which should be read and set by proxies to detect if they are being used in a loop. YARP should be able to add itself and detect if its already listed as a proxy in the request chain.

```
1. Introduction

In modern deployments of HTTP servers, it is common to interpose
Content Delivery Networks (CDNs) in front of origin servers to
improve latency perceived by end users, reduce operational costs, and
improve scalability and reliability of services.

Often, more than one CDN is in use by a given origin. This happens
for a variety of reasons, such as cost savings, arranging for
failover should one CDN have issues, or direct comparison of the
CDNs' services.

As a result, it is possible for forwarding CDNs to be configured in a
"loop" accidentally; because routing is achieved through a
combination of DNS and forwarding rules, and site configurations are
sometimes complex and managed by several parties.

When this happens, it is difficult to debug. Additionally, it
sometimes isn't accidental; loops between multiple CDNs can be used
as an attack vector (e.g., see [loop-attack]), especially if one CDN
unintentionally strips the loop detection headers of another.

This specification defines the CDN-Loop HTTP request header field to
help detect such attacks and accidents among forwarding CDNs that
have implemented it; the header field may not be modified by their
customers.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.