| | | 1 | | using System.Globalization; |
| | | 2 | | using System.Net; |
| | | 3 | | using Microsoft.AspNetCore.HttpOverrides; |
| | | 4 | | using Microsoft.Extensions.Options; |
| | | 5 | | using ProjectTemplate.Web.Options; |
| | | 6 | | using NetIPNetwork = System.Net.IPNetwork; |
| | | 7 | | |
| | | 8 | | namespace ProjectTemplate.Web.Extensions; |
| | | 9 | | |
| | | 10 | | /// <summary> |
| | | 11 | | /// Provides service and middleware registration for configurable forwarded headers support. |
| | | 12 | | /// </summary> |
| | | 13 | | public static class ForwardedHeadersExtensions |
| | | 14 | | { |
| | | 15 | | /// <summary> |
| | | 16 | | /// Registers forwarded headers configuration from appsettings.json. |
| | | 17 | | /// </summary> |
| | | 18 | | /// <param name="services">The service collection.</param> |
| | | 19 | | /// <param name="configuration">Application configuration.</param> |
| | | 20 | | /// <returns>The same service collection for chaining.</returns> |
| | | 21 | | public static IServiceCollection AddApplicationForwardedHeaders( |
| | | 22 | | this IServiceCollection services, |
| | | 23 | | IConfiguration configuration) |
| | | 24 | | { |
| | 164 | 25 | | services |
| | 164 | 26 | | .AddOptions<ApplicationForwardedHeadersOptions>() |
| | 164 | 27 | | .Bind(configuration.GetSection(ApplicationForwardedHeadersOptions.SectionName)) |
| | 164 | 28 | | .Validate( |
| | 286 | 29 | | options => options.ForwardLimit is null or > 0, |
| | 164 | 30 | | "ProjectTemplate:ForwardedHeaders:ForwardLimit must be null or greater than zero.") |
| | 164 | 31 | | .Validate( |
| | 286 | 32 | | options => options.Headers.All(IsValidForwardedHeader), |
| | 164 | 33 | | "ProjectTemplate:ForwardedHeaders:Headers contains an invalid forwarded header value.") |
| | 164 | 34 | | .Validate( |
| | 314 | 35 | | options => options.KnownProxies.All(proxy => IPAddress.TryParse(proxy, out _)), |
| | 164 | 36 | | "ProjectTemplate:ForwardedHeaders:KnownProxies must contain valid IP addresses.") |
| | 164 | 37 | | .Validate( |
| | 286 | 38 | | options => options.KnownNetworks.All(IsValidKnownNetwork), |
| | 164 | 39 | | "ProjectTemplate:ForwardedHeaders:KnownNetworks must contain valid CIDR ranges such as 10.0.0.0/24.") |
| | 164 | 40 | | .Validate( |
| | 164 | 41 | | options => |
| | 286 | 42 | | !options.Headers.Any(IsForwardedHost) || |
| | 290 | 43 | | options.AllowedHosts.Any(host => !string.IsNullOrWhiteSpace(host)), |
| | 164 | 44 | | "ProjectTemplate:ForwardedHeaders:AllowedHosts must contain at least one host when XForwardedHost is ena |
| | 164 | 45 | | .ValidateOnStart(); |
| | | 46 | | |
| | 164 | 47 | | services.Configure<ForwardedHeadersOptions>(options => |
| | 164 | 48 | | { |
| | 132 | 49 | | ApplicationForwardedHeadersOptions settings = |
| | 132 | 50 | | configuration |
| | 132 | 51 | | .GetSection(ApplicationForwardedHeadersOptions.SectionName) |
| | 132 | 52 | | .Get<ApplicationForwardedHeadersOptions>() |
| | 132 | 53 | | ?? new ApplicationForwardedHeadersOptions(); |
| | 164 | 54 | | |
| | 132 | 55 | | options.ForwardedHeaders = settings.Enabled |
| | 132 | 56 | | ? BuildForwardedHeaders(settings.Headers) |
| | 132 | 57 | | : ForwardedHeaders.None; |
| | 164 | 58 | | |
| | 132 | 59 | | options.ForwardLimit = settings.ForwardLimit; |
| | 132 | 60 | | options.RequireHeaderSymmetry = settings.RequireHeaderSymmetry; |
| | 164 | 61 | | |
| | 132 | 62 | | if (settings.ClearKnownNetworksAndProxies) |
| | 164 | 63 | | { |
| | 10 | 64 | | options.KnownProxies.Clear(); |
| | 10 | 65 | | options.KnownIPNetworks.Clear(); |
| | 164 | 66 | | } |
| | 164 | 67 | | |
| | 294 | 68 | | foreach (string proxy in settings.KnownProxies.Where(value => !string.IsNullOrWhiteSpace(value))) |
| | 164 | 69 | | { |
| | 10 | 70 | | options.KnownProxies.Add(IPAddress.Parse(proxy)); |
| | 164 | 71 | | } |
| | 164 | 72 | | |
| | 288 | 73 | | foreach (string network in settings.KnownNetworks.Where(value => !string.IsNullOrWhiteSpace(value))) |
| | 164 | 74 | | { |
| | 8 | 75 | | options.KnownIPNetworks.Add(ParseIPNetwork(network)); |
| | 164 | 76 | | } |
| | 164 | 77 | | |
| | 132 | 78 | | if (settings.AllowedHosts.Length > 0) |
| | 164 | 79 | | { |
| | 4 | 80 | | options.AllowedHosts.Clear(); |
| | 164 | 81 | | |
| | 26 | 82 | | foreach (string host in settings.AllowedHosts.Where(value => !string.IsNullOrWhiteSpace(value))) |
| | 164 | 83 | | { |
| | 6 | 84 | | options.AllowedHosts.Add(host); |
| | 164 | 85 | | } |
| | 164 | 86 | | } |
| | 296 | 87 | | }); |
| | | 88 | | |
| | 164 | 89 | | return services; |
| | | 90 | | } |
| | | 91 | | |
| | | 92 | | /// <summary> |
| | | 93 | | /// Adds forwarded headers middleware only when enabled by configuration. |
| | | 94 | | /// </summary> |
| | | 95 | | /// <param name="app">The application builder.</param> |
| | | 96 | | /// <returns>The same application builder for chaining.</returns> |
| | | 97 | | public static IApplicationBuilder UseApplicationForwardedHeaders(this IApplicationBuilder app) |
| | | 98 | | { |
| | 148 | 99 | | ApplicationForwardedHeadersOptions settings = |
| | 148 | 100 | | app.ApplicationServices |
| | 148 | 101 | | .GetRequiredService<IOptions<ApplicationForwardedHeadersOptions>>() |
| | 148 | 102 | | .Value; |
| | | 103 | | |
| | 142 | 104 | | return settings.Enabled ? app.UseForwardedHeaders() : app; |
| | | 105 | | } |
| | | 106 | | |
| | | 107 | | private static ForwardedHeaders BuildForwardedHeaders(IEnumerable<string> headers) |
| | | 108 | | { |
| | 128 | 109 | | ForwardedHeaders forwardedHeaders = ForwardedHeaders.None; |
| | | 110 | | |
| | 1288 | 111 | | foreach (string header in headers) |
| | | 112 | | { |
| | 516 | 113 | | if (TryParseForwardedHeader(header, out ForwardedHeaders parsedHeader)) |
| | | 114 | | { |
| | 516 | 115 | | forwardedHeaders |= parsedHeader; |
| | | 116 | | } |
| | | 117 | | } |
| | | 118 | | |
| | 128 | 119 | | return forwardedHeaders; |
| | | 120 | | } |
| | | 121 | | |
| | | 122 | | private static bool IsValidForwardedHeader(string value) |
| | | 123 | | { |
| | 1140 | 124 | | return TryParseForwardedHeader(value, out _); |
| | | 125 | | } |
| | | 126 | | |
| | | 127 | | private static bool TryParseForwardedHeader(string? value, out ForwardedHeaders forwardedHeader) |
| | | 128 | | { |
| | 2796 | 129 | | forwardedHeader = ForwardedHeaders.None; |
| | | 130 | | |
| | 2796 | 131 | | if (string.IsNullOrWhiteSpace(value)) |
| | | 132 | | { |
| | 0 | 133 | | return false; |
| | | 134 | | } |
| | | 135 | | |
| | 2796 | 136 | | string normalizedValue = value |
| | 2796 | 137 | | .Trim() |
| | 2796 | 138 | | .Replace("-", string.Empty, StringComparison.Ordinal) |
| | 2796 | 139 | | .Replace("_", string.Empty, StringComparison.Ordinal); |
| | | 140 | | |
| | 2796 | 141 | | return Enum.TryParse(normalizedValue, ignoreCase: true, out forwardedHeader); |
| | | 142 | | } |
| | | 143 | | |
| | | 144 | | private static bool IsValidKnownNetwork(string value) |
| | | 145 | | { |
| | | 146 | | try |
| | | 147 | | { |
| | 24 | 148 | | _ = ParseIPNetwork(value); |
| | 20 | 149 | | return true; |
| | | 150 | | } |
| | 4 | 151 | | catch |
| | | 152 | | { |
| | 4 | 153 | | return false; |
| | | 154 | | } |
| | 24 | 155 | | } |
| | | 156 | | |
| | | 157 | | private static NetIPNetwork ParseIPNetwork(string value) |
| | | 158 | | { |
| | 32 | 159 | | string[] parts = value.Split('/', StringSplitOptions.TrimEntries); |
| | | 160 | | |
| | 32 | 161 | | if (parts.Length != 2) |
| | | 162 | | { |
| | 4 | 163 | | throw new FormatException($"Invalid CIDR notation: {value}"); |
| | | 164 | | } |
| | | 165 | | |
| | 28 | 166 | | var prefix = IPAddress.Parse(parts[0]); |
| | 28 | 167 | | int prefixLength = int.Parse(parts[1], CultureInfo.InvariantCulture); |
| | | 168 | | |
| | 28 | 169 | | return new NetIPNetwork(prefix, prefixLength); |
| | | 170 | | } |
| | | 171 | | |
| | | 172 | | private static bool IsForwardedHost(string value) |
| | | 173 | | { |
| | 1140 | 174 | | return TryParseForwardedHeader(value, out ForwardedHeaders forwardedHeader) && |
| | 1140 | 175 | | forwardedHeader.HasFlag(ForwardedHeaders.XForwardedHost); |
| | | 176 | | } |
| | | 177 | | } |