dotnet / dotnet/yarp

YARP with ForwardedHeadersMiddleware doesn't produce expected backend request headers

Open
#1,331 6 comments 1 reaction 0 assignees View on GitHub
Type: Documentation
Dominant language
C#
Stars
9.6k
Forks
933
Avg merge
12d 18h
Merged PRs (30d)
2

Description

### Describe the bug
Using `{"X-Forwarded": "Append"}` with [`ForwardedHeadersMiddleware`](https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-5.0) doesn't produce expected backend request headers.

My application is running behind a reverse proxy (HAProxy). HAProxy sets the X-Forwarded-For and related headers. I've configured my application to use the `ForwardedHeadersMiddleware`, which updates `HttpContext.Connection.RemoteIpAddress` as expected. I expect that having a transform `{"X-Forwarded": "Append"}` would append the original IP address. However the XFF header isn't changed.

Imagine the following request: Client -> HAProxy -> Application -> Backend

The request received from HAProxy by Application is:
```
RemoteIpAddress: IP(HAProxy)
X-Forwarded-For: IP(Client)
```

After applying ForwardedHeadersMiddleware the request looks like this:
```
RemoteIpAddress: IP(Client)
X-Forwarded-For: IP(Client)
X-Original-For: IP(HAProxy):Port
```

The request created by YARP for Backend becomes:
```
X-Forwarded-For: IP(Client)
X-Original-For: IP(HAProxy):Port
```

However I expected the request to be:
```
X-Forwarded-For: IP(Client), IP(HAProxy)
X-Original-For: IP(HAProxy):Port (this header is not needed, but could be filtered through a transform)
```

### Further technical details

- Include the version of the packages you are using: rc1
- The platform (Linux/macOS/Windows): macOS + Windows

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.