Add KnownProxies configuration - #735

Failure is unrelated.

Thanks for the PR!!! I wonder if our ordering for forwarded headers is in the correct spot too https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1#forwarded-headers-middleware-order Also from the discussion here I wonder if we also need to have KnownNetworks (dotnet/AspNetCore.Docs#2384) Maybe not? All the docs only mention knownproxies (https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-nginx?view=aspnetcore-3.1) I'm curious what was the scenarios/setup you tested this with (I think you mentioned docker-compose earlier)? Also this is interesting: dotnet/AspNetCore.Docs#12349 and https://soapfault.com/2020/02/24/asp-net-core-reverse-proxy-and-x-forwarded-headers/ cc @ejsmith

I think the location is fine, if it even matters. I've created a reverse proxy in IIS and the KnownProxies must be set, otherwise .NET Core doesn't know which IP is the proxy.

KnownNetworks is only required to limit where the forwarded headers can come from.

Thank you very much for helping us with this issue!

I noticed on this blog post they are saying to clear the KnownProxies list. I wonder if that would be a better way for Exceptionless to handle this issue. I think it can be somewhat of a security concern if you are using those things for any sort of access rules. In Exceptionless I believe we are simply using them to populate information about the events. So seems like it would be OK and it would make it work in all scenarios without configuration. Thoughts?

Here is a docs page about it too: https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1#forward-the-scheme-for-linux-and-non-iis-reverse-proxies

Clearing them doesn't work with IIS, it'll need to be specified explicitly. It also says that ("To forward the scheme from the proxy in non-IIS scenarios"). Normally only the IPv6 loopback is added. Basically with this change it stays as-is but enables Exceptionless to be reverse proxied through IIS 😊

Hmm... they seemed to indicate that it would work with IIS automatically.

I've tried that already, but it doesn't work for me unless KnownProxies is correctly specified.

Did you try adding UseIISIntegration?

Actually, that should be on already as ConfigureWebHostDefaults appears to do it.

Ok, hmm... so my understanding is that the KnownProxies list is basically white listing entries, but if the list is empty it should work always if those headers are present. I'm just trying to understand this because ideally I don't want to have to add an extra configuration step.

Looking at the code here: https://github.com/dotnet/aspnetcore/blob/master/src/Middleware/HttpOverrides/src/ForwardedHeadersMiddleware.cs#L223

It seems like from reading that code if both of those collections are empty then it bypasses any known hosts checks and if the headers are present it should use them. But you are saying that you set both collections to empty and it did not apply your incoming X-Forwarded headers, correct?

Update: clearing all Known... properties seems to work as well, let me try some more.

For what it's worth, it's also possible to use KnownNetworks, e.g. options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("172.18.0.0"), 16)); But this format isn't very friendly as it's not CIDR notation. I could add this also and make it something like KnownNetworks: strings in format IP-PrefixLength

:-) I was going to say... I read that code and I don't see how it would be checking if both are empty. I feel like in general they need to be careful with setting these things because people might be making security decisions based on their values. But in our case we are not and in general if we are able to just use these always and not have to have a config option for this, that is what I would prefer. Can you do some testing and let me know what you find out? Thank you!!

That indeed seems to work as well. I'll update to the code to clear them all by default, that seems to be enough 😊

Awesome! Thank you @PhyxionNL !!

#736

Thanks!