| | | 1 | | using Microsoft.Extensions.Options; |
| | | 2 | | using ProjectTemplate.Web.Options; |
| | | 3 | | |
| | | 4 | | namespace ProjectTemplate.Web.Diagnostics; |
| | | 5 | | |
| | | 6 | | /// <summary> |
| | | 7 | | /// Reports likely forwarded-header trust misconfiguration when client-IP rate limiting is enabled. |
| | | 8 | | /// </summary> |
| | 144 | 9 | | internal sealed partial class ForwardedHeadersTrustDiagnosticsHostedService( |
| | 144 | 10 | | IOptions<ApplicationForwardedHeadersOptions> forwardedHeadersOptions, |
| | 144 | 11 | | IOptions<ApplicationRateLimitingOptions> rateLimitingOptions, |
| | 144 | 12 | | IHostEnvironment environment, |
| | 144 | 13 | | ILogger<ForwardedHeadersTrustDiagnosticsHostedService> logger) : IHostedService |
| | | 14 | | { |
| | | 15 | | private const string _strictValidationFailureMessage = |
| | | 16 | | "Forwarded headers and client-IP rate limiting are enabled, but no trusted proxy or network is configured. " + |
| | | 17 | | "Configure ProjectTemplate:ForwardedHeaders:KnownProxies or KnownNetworks before enabling strict proxy trust val |
| | | 18 | | |
| | 144 | 19 | | private readonly ApplicationForwardedHeadersOptions _forwardedHeadersOptions = forwardedHeadersOptions.Value; |
| | 144 | 20 | | private readonly ApplicationRateLimitingOptions _rateLimitingOptions = rateLimitingOptions.Value; |
| | 144 | 21 | | private readonly IHostEnvironment _environment = environment; |
| | | 22 | | |
| | | 23 | | /// <inheritdoc /> |
| | | 24 | | public Task StartAsync(CancellationToken cancellationToken) |
| | | 25 | | { |
| | 144 | 26 | | if (!RequiresExplicitProxyTrust( |
| | 144 | 27 | | _forwardedHeadersOptions, |
| | 144 | 28 | | _rateLimitingOptions, |
| | 144 | 29 | | _environment)) |
| | | 30 | | { |
| | 16 | 31 | | return Task.CompletedTask; |
| | | 32 | | } |
| | | 33 | | |
| | 128 | 34 | | if (_forwardedHeadersOptions.RequireExplicitProxyTrust) |
| | | 35 | | { |
| | 2 | 36 | | throw new InvalidOperationException(_strictValidationFailureMessage); |
| | | 37 | | } |
| | | 38 | | |
| | 126 | 39 | | LogMissingExplicitProxyTrust(logger, _environment.EnvironmentName); |
| | 126 | 40 | | return Task.CompletedTask; |
| | | 41 | | } |
| | | 42 | | |
| | | 43 | | /// <inheritdoc /> |
| | | 44 | | public Task StopAsync(CancellationToken cancellationToken) |
| | | 45 | | { |
| | 272 | 46 | | return Task.CompletedTask; |
| | | 47 | | } |
| | | 48 | | |
| | | 49 | | internal static bool RequiresExplicitProxyTrust( |
| | | 50 | | ApplicationForwardedHeadersOptions forwardedHeadersOptions, |
| | | 51 | | ApplicationRateLimitingOptions rateLimitingOptions, |
| | | 52 | | IHostEnvironment environment) |
| | | 53 | | { |
| | 144 | 54 | | ArgumentNullException.ThrowIfNull(forwardedHeadersOptions); |
| | 144 | 55 | | ArgumentNullException.ThrowIfNull(rateLimitingOptions); |
| | 144 | 56 | | ArgumentNullException.ThrowIfNull(environment); |
| | | 57 | | |
| | 144 | 58 | | return !environment.IsDevelopment() && |
| | 144 | 59 | | forwardedHeadersOptions.Enabled && |
| | 144 | 60 | | ProcessesForwardedFor(forwardedHeadersOptions.Headers) && |
| | 144 | 61 | | rateLimitingOptions.Enabled && |
| | 144 | 62 | | !HasConfiguredTrustBoundary(forwardedHeadersOptions); |
| | | 63 | | } |
| | | 64 | | |
| | | 65 | | private static bool ProcessesForwardedFor(IEnumerable<string> headers) |
| | | 66 | | { |
| | 140 | 67 | | return headers.Any(header => |
| | 280 | 68 | | string.Equals( |
| | 280 | 69 | | NormalizeHeaderName(header), |
| | 280 | 70 | | "XForwardedFor", |
| | 280 | 71 | | StringComparison.OrdinalIgnoreCase)); |
| | | 72 | | } |
| | | 73 | | |
| | | 74 | | private static bool HasConfiguredTrustBoundary(ApplicationForwardedHeadersOptions options) |
| | | 75 | | { |
| | 146 | 76 | | return options.KnownProxies.Any(value => !string.IsNullOrWhiteSpace(value)) || |
| | 140 | 77 | | options.KnownNetworks.Any(value => !string.IsNullOrWhiteSpace(value)); |
| | | 78 | | } |
| | | 79 | | |
| | | 80 | | private static string NormalizeHeaderName(string? value) |
| | | 81 | | { |
| | 140 | 82 | | return value? |
| | 140 | 83 | | .Trim() |
| | 140 | 84 | | .Replace("-", string.Empty, StringComparison.Ordinal) |
| | 140 | 85 | | .Replace("_", string.Empty, StringComparison.Ordinal) |
| | 140 | 86 | | ?? string.Empty; |
| | | 87 | | } |
| | | 88 | | |
| | | 89 | | [LoggerMessage( |
| | | 90 | | EventId = 5101, |
| | | 91 | | Level = LogLevel.Warning, |
| | | 92 | | Message = "Forwarded headers and client-IP rate limiting are enabled in environment {EnvironmentName}, but no de |
| | | 93 | | private static partial void LogMissingExplicitProxyTrust( |
| | | 94 | | ILogger logger, |
| | | 95 | | string environmentName); |
| | | 96 | | } |