Skip to content

Add forwarded-header trust startup diagnostics#380

Merged
cdcavell merged 15 commits into
mainfrom
feature/issue-373-forwarded-header-diagnostics
Jul 19, 2026
Merged

Add forwarded-header trust startup diagnostics#380
cdcavell merged 15 commits into
mainfrom
feature/issue-373-forwarded-header-diagnostics

Conversation

@cdcavell

@cdcavell cdcavell commented Jul 19, 2026

Copy link
Copy Markdown
Owner

Summary

  • add startup diagnostics when forwarded client-IP processing and rate limiting are enabled without an explicit trusted proxy or network
  • warn that untrusted forwarded values can leave clients sharing a proxy rate-limit bucket and produce misleading client-IP logs
  • add an opt-in ProjectTemplate:ForwardedHeaders:RequireExplicitProxyTrust mode that fails startup outside Development
  • preserve ASP.NET Core's trusted-proxy protections and never parse or trust raw X-Forwarded-For values
  • add focused warning, strict-validation, Development, and configured-trust tests

Validation

CI is in progress.

Fixes / Closes #373

Comment on lines +15 to +17
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
with:
ref: feature/issue-373-forwarded-header-diagnostics
@cdcavell
cdcavell marked this pull request as ready for review July 19, 2026 22:20
@cdcavell
cdcavell merged commit c24f651 into main Jul 19, 2026
14 checks passed
@cdcavell
cdcavell deleted the feature/issue-373-forwarded-header-diagnostics branch July 19, 2026 22:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add startup diagnostics for forwarded-header trust and client-IP rate limiting

2 participants