Allow reverse proxies to pass forwarded headers allowing for api acce…

…ss without disabling https redirection middleware (#1937) * Working concept. * only add forwarding headers if known proxies is non-empty --------- Co-authored-by: Robbie Lodico <[email protected]>
AscensionGameDev · Oct 10, 2023 · e83f25f · e83f25f
1 parent 0459dcf
commit e83f25f
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 0 deletions.
diff --git a/Intersect.Server/Web/Net7/ApiService.cs b/Intersect.Server/Web/Net7/ApiService.cs
@@ -1,3 +1,4 @@
+using System.Net;
 using System.Reflection;
 using System.Threading.RateLimiting;
 using Intersect.Core;
@@ -17,6 +18,7 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Cors.Infrastructure;
 using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.OData;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
@@ -208,8 +210,30 @@ internal partial class ApiService : ApplicationService<ServerContext, IApiServic
             builder.Services.AddProblemDetails();
         }
 
+        if (configuration.KnownProxies.Count > 0)
+        {
+            builder.Services.Configure<ForwardedHeadersOptions>(options =>
+            {
+                options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost;
+
+                foreach (var proxy in configuration.KnownProxies)
+                {
+                    if (IPAddress.TryParse(proxy, out IPAddress address))
+                    {
+                        Log.Info($"Added \"{proxy}\" as good known proxy for forwarded headers middleware.");
+                        options.KnownProxies.Add(address);
+                    }
+                    else
+                    {
+                        Log.Error($"Failed to parse \"{proxy}\" as good known proxy for forwarded headers middleware.");
+                    }
+                }
+            });
+        }
+
         var app = builder.Build();
 
+        app.UseForwardedHeaders();
         app.UseNetworkFilterMiddleware(configuration.AllowedNetworkTypes);
 
         if (app.Environment.IsDevelopment())

diff --git a/Intersect.Server/Web/Net7/Configuration/ApiConfiguration.cs b/Intersect.Server/Web/Net7/Configuration/ApiConfiguration.cs
@@ -1,5 +1,6 @@
 using System.Collections.Immutable;
 using System.ComponentModel;
+using System.Net;
 using Intersect.Server.Web.RestApi.Configuration;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Cors.Infrastructure;
@@ -51,6 +52,9 @@ public ImmutableDictionary<string, CorsPolicy>? Cors
         [JsonProperty(NullValueHandling = NullValueHandling.Ignore, DefaultValueHandling = DefaultValueHandling.Ignore)]
         public TokenGenerationOptions? TokenGenerationOptions { get; set; }
 
+        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
+        public List<string> KnownProxies { get; set; } = new List<string>();
+
         #endregion
     }
 }