Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

X-Forwarded-Proto isn't respected in MVC Request due to wrong server variable being set #118

Closed
DorianGreen opened this issue Jul 20, 2022 · 3 comments · Fixed by #123
Closed
Assignees
Milestone

Comments

@DorianGreen
Copy link

Describe the bug

ProxyHeaderModule is currently setting the SERVER_PROTOCOL variable based on x-forwarded-proto.
This variable is should be used to denote the HTTP protocol (i.e. HTTP/1.1 or HTTP2) and not the scheme (HTTP vs HTTPS).
IIS/ASP.NET use the HTTPS boolean server variable for the scheme.

To Reproduce

  1. send a request to any controller action with http scheme, adding a X-Forwarded-Proto=https header
  2. in the action check context..Request.RequestUri.Scheme
  3. value should be https but returns http
@twsouthwick
Copy link
Member

@DorianGreen This has been fixed and will be available in preview 3. See #92

@DorianGreen
Copy link
Author

The fix doesn't address the issue, it sets the correct port, but not the correct scheme.

SERVER_PROTOCOL is the wrong variable to set, and MVC webapi doesn't know how to handle it.

SERVER_PROTOCOL should be used for HTTP1.1 vs HTTP2 and not for HTTP vs HTTPS.

the correct server variable to set is HTTPS with a value of ON for HTTPS and OFF for HTTP.

@twsouthwick
Copy link
Member

OK. I'll reopen and look into this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants