From ffe6c56860f58bcf457db698d66e2a24f2fc6b88 Mon Sep 17 00:00:00 2001 From: Rick Anderson <3605364+Rick-Anderson@users.noreply.github.com> Date: Wed, 12 Jan 2022 12:52:22 -1000 Subject: [PATCH] Use AddHttpLogging API in sample code /1 (#24558) * Use AddHttpLogging API in sample code /1 * Use AddHttpLogging API in sample code /1 * Use AddHttpLogging API in sample code /1 * Use AddHttpLogging API in sample code /1 * clean up * Update aspnetcore/host-and-deploy/proxy-load-balancer.md Co-authored-by: Chris Ross Co-authored-by: Chris Ross --- .../host-and-deploy/proxy-load-balancer.md | 27 ++-- .../6.1samples/WebPS/Program.cs | 138 +++++++++++++++++- .../WebPS/appsettings.Development.json | 3 +- 3 files changed, 154 insertions(+), 14 deletions(-) diff --git a/aspnetcore/host-and-deploy/proxy-load-balancer.md b/aspnetcore/host-and-deploy/proxy-load-balancer.md index 35272f0275..2fc9878a9c 100644 --- a/aspnetcore/host-and-deploy/proxy-load-balancer.md +++ b/aspnetcore/host-and-deploy/proxy-load-balancer.md @@ -196,34 +196,37 @@ If the proxy isn't base64-encoding the certificate, as is the case with Nginx, s ## Troubleshoot -When headers aren't forwarded as expected, enable [logging](xref:fundamentals/logging/index). If the logs don't provide sufficient information to troubleshoot the problem, enumerate the request headers received by the server. Use inline middleware to write request headers to an app response or log the headers. +When headers aren't forwarded as expected, enable `debug` level [logging](xref:fundamentals/logging/index) and HTTP request logging. must be called after : -To write the headers to the app's response, place the following terminal inline middleware immediately after the call to : + -[!code-csharp[](~/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/Program.cs?name=snippet_trb2&highlight=17-35)] +[!code-csharp[](~/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/Program.cs?name=snippet_trb22&highlight=8-11,21-31)] When processed, `X-Forwarded-{For|Proto|Host}` values are moved to `X-Original-{For|Proto|Host}`. If there are multiple values in a given header, Forwarded Headers Middleware processes headers in reverse order from right to left. The default `ForwardLimit` is `1` (one), so only the rightmost value from the headers is processed unless the value of `ForwardLimit` is increased. -The request's original remote IP must match an entry in the `KnownProxies` or `KnownNetworks` lists before forwarded headers are processed. This limits header spoofing by not accepting forwarders from untrusted proxies. When an unknown proxy is detected, logging indicates the address of the proxy: +The request's original remote IP must match an entry in the or lists before forwarded headers are processed. This limits header spoofing by not accepting forwarders from untrusted proxies. When an unknown proxy is detected, logging indicates the address of the proxy: ```console September 20th 2018, 15:49:44.168 Unknown proxy: 10.0.0.100:54321 ``` -In the preceding example, 10.0.0.100 is a proxy server. If the server is a trusted proxy, add the server's IP address to `KnownProxies` (or add a trusted network to `KnownNetworks`). For more information, see the [Forwarded Headers Middleware options](#forwarded-headers-middleware-options) section. +In the preceding example, 10.0.0.100 is a proxy server. If the server is a trusted proxy, add the server's IP address to `KnownProxies`, or add a trusted network to `KnownNetworks`. For more information, see the [Forwarded Headers Middleware options](#forwarded-headers-middleware-options) section. -```csharp -builder.Services.Configure(options => -{ - options.KnownProxies.Add(IPAddress.Parse("10.0.0.100")); -}); -``` +[!code-csharp[](~/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/Program.cs?name=snippet_kp&highlight=11)] + +To display the logs, add `"Microsoft.AspNetCore.HttpLogging": "Information"` to the *appsettings.Development.json* file: + +[!code-xml[](~/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/appsettings.Development.json?highlight=7)] > [!IMPORTANT] > Only allow trusted proxies and networks to forward headers. Otherwise, [IP spoofing](https://www.iplocation.net/ip-spoofing) attacks are possible. diff --git a/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/Program.cs b/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/Program.cs index 52ea8240c4..870c69e9f5 100644 --- a/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/Program.cs +++ b/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/Program.cs @@ -1,4 +1,4 @@ -#define TRB2 // FIRST SECOND FMHO DH LN AZ OWP OWP2 TRB TRB2 HTTPS HTTPS2 +#define KP // FIRST SECOND FMHO DH LN AZ OWP OWP2 TRB TRB2 HTTPS HTTPS2 TRB3 TRB22 KP #if NEVER #elif FIRST #region snippet1 @@ -384,6 +384,104 @@ app.UseAuthorization(); app.MapRazorPages(); +app.Run(); +#endregion +#elif TRB22 // Replaces TRB2 +#region snippet_trb22 +using Microsoft.AspNetCore.HttpLogging; +using Microsoft.AspNetCore.HttpOverrides; + +var builder = WebApplication.CreateBuilder(args); + +builder.Services.AddRazorPages(); + +builder.Services.AddHttpLogging(options => +{ + options.LoggingFields = HttpLoggingFields.RequestPropertiesAndHeaders; +}); + +builder.Services.Configure(options => +{ + options.ForwardedHeaders = + ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto; +}); + +var app = builder.Build(); + +app.UseForwardedHeaders(); +app.UseHttpLogging(); + +app.Use(async (context, next) => +{ + // Connection: RemoteIp + app.Logger.LogInformation("Request RemoteIp: {RemoteIpAddress}", + context.Connection.RemoteIpAddress); + + await next(context); +}); + +if (!app.Environment.IsDevelopment()) +{ + app.UseExceptionHandler("/Error"); + app.UseHsts(); +} + +app.UseHttpsRedirection(); +app.UseStaticFiles(); + +app.UseAuthorization(); + +app.MapRazorPages(); + +app.Run(); +#endregion +#elif TRB3 // replaces TRB with AddHttpLogging +#region snippet_trb3 +using Microsoft.AspNetCore.HttpLogging; +using Microsoft.AspNetCore.HttpOverrides; + +var builder = WebApplication.CreateBuilder(args); + +builder.Services.AddRazorPages(); +builder.Services.AddHttpLogging(options => +{ + options.LoggingFields = HttpLoggingFields.RequestPropertiesAndHeaders; +}); + +builder.Services.Configure(options => +{ + options.ForwardedHeaders = + ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto; +}); + +var app = builder.Build(); + +app.UseForwardedHeaders(); +app.UseHttpLogging(); + +app.Run(async (context) => +{ + context.Response.ContentType = "text/plain"; + // Connection: RemoteIp + await context.Response.WriteAsync( + $"Request RemoteIp: {context.Connection.RemoteIpAddress}"); +}); + +if (!app.Environment.IsDevelopment()) +{ + app.UseExceptionHandler("/Error"); + app.UseHsts(); +} + +app.UseHttpsRedirection(); +app.UseStaticFiles(); + +app.UseRouting(); + +app.UseAuthorization(); + +app.MapRazorPages(); + app.Run(); #endregion #elif HTTPS @@ -463,6 +561,44 @@ app.UseAuthorization(); app.MapRazorPages(); +app.Run(); +#endregion +#elif KP +#region snippet_kp +using Microsoft.AspNetCore.HttpOverrides; +using System.Net; + +var builder = WebApplication.CreateBuilder(args); + +builder.Services.AddRazorPages(); +builder.Services.Configure(options => +{ + options.ForwardedHeaders = + ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto; + options.KnownProxies.Add(IPAddress.Parse("10.0.0.100")); +}); + +var app = builder.Build(); + +if (!app.Environment.IsDevelopment()) +{ + app.UseExceptionHandler("/Error"); + app.UseForwardedHeaders(); + app.UseHsts(); +} +else +{ + app.UseDeveloperExceptionPage(); + app.UseForwardedHeaders(); +} + +app.UseHttpsRedirection(); +app.UseStaticFiles(); + +app.UseAuthorization(); + +app.MapRazorPages(); + app.Run(); #endregion #endif diff --git a/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/appsettings.Development.json b/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/appsettings.Development.json index 770d3e9314..40c34ddc3a 100644 --- a/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/appsettings.Development.json +++ b/aspnetcore/host-and-deploy/proxy-load-balancer/6.1samples/WebPS/appsettings.Development.json @@ -3,7 +3,8 @@ "Logging": { "LogLevel": { "Default": "Information", - "Microsoft.AspNetCore": "Warning" + "Microsoft.AspNetCore": "Warning", + "Microsoft.AspNetCore.HttpLogging": "Information" } } }