Document .NET 8 breaking change: Forwarded Headers Middleware ignores X-Forwarded-* headers from unknown proxies #47985
Conversation
… .NET 8 Co-authored-by: gewarren <[email protected]>
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 issues. Other issues are also a high priority. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans. ✅ No issues foundMore information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
Copilot
AI
changed the title
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 issues. Other issues are also a high priority. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans. ✅ No issues foundMore information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
PoliCheck Scan ReportThe following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 issues. Other issues are also a high priority. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans. ✅ No issues foundMore information about PoliCheckInformation: PoliCheck | Severity Guidance | Term |
This PR documents the breaking change introduced in ASP.NET Core 8.0.17 where the Forwarded Headers Middleware now ignores
X-Forwarded-*headers from proxies that are not explicitly configured as trusted.Changes Made
Created new breaking change document:
docs/core/compatibility/aspnet-core/8.0/forwarded-headers-unknown-proxies.mdUpdated main breaking changes index:
docs/core/compatibility/8.0.mdKey Details
The breaking change affects applications that rely on forwarded headers from proxies not configured in the trusted proxy list (
KnownProxiesandKnownNetworks). Previously, headers likeX-Forwarded-Prefix,X-Forwarded-Proto, andX-Forwarded-Hostwere processed from any source, but now only trusted proxies are honored for security reasons.This can cause issues like infinite redirects with HTTPS redirection middleware or authentication failures when using TLS termination, requiring developers to properly configure their proxy topology or use workarounds like the
ASPNETCORE_FORWARDEDHEADERS_ENABLEDenvironment variable.The documentation follows Microsoft's breaking change documentation guidelines and includes proper API cross-references, code examples, and links to related proxy configuration documentation.
Fixes #47446.
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.
Internal previews