Harden forwarded headers trust configuration

Move forwarded headers proxy/CIDR parsing into service extensions and enforce fail-closed behavior outside Development when trusted proxies are not configured. Add ForwardedHeaders config section with TrustedProxyCidrs/TrustedProxies defaults.

Author: BenjaminMichaelis

EssentialCSharp.Web/Extensions/IServiceCollectionExtensions.cs

@@ -1,4 +1,7 @@
-using EssentialCSharp.Web.Services;
+using System.Net;
+using System.Net.Sockets;
+using EssentialCSharp.Web.Services;
+using Microsoft.AspNetCore.HttpOverrides;
 
 namespace EssentialCSharp.Web.Extensions;
 
@@ -13,4 +16,77 @@ public static void AddCaptchaService(this IServiceCollection services, IConfigur
             c.BaseAddress = new Uri("https://api.hcaptcha.com");
         });
     }
+
+    public static void AddTrustedForwardedHeaders(this IServiceCollection services, IConfiguration configuration, IHostEnvironment environment)
+    {
+        services.Configure<ForwardedHeadersOptions>(options =>
+        {
+            options.ForwardedHeaders =
+                ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
+            options.ForwardLimit = 1;
+
+            var trustedProxyCidrs = configuration
+                .GetSection("ForwardedHeaders:TrustedProxyCidrs")
+                .Get<string[]>() ?? [];
+            var trustedProxies = configuration
+                .GetSection("ForwardedHeaders:TrustedProxies")
+                .Get<string[]>() ?? [];
+
+            if (trustedProxyCidrs.Length == 0 && trustedProxies.Length == 0)
+            {
+                if (!environment.IsDevelopment())
+                {
+                    throw new InvalidOperationException(
+                        "Forwarded headers are enabled but no trusted proxies are configured. " +
+                        "Set ForwardedHeaders:TrustedProxyCidrs or ForwardedHeaders:TrustedProxies.");
+                }
+                return;
+            }
+
+            options.KnownIPNetworks.Clear();
+            options.KnownProxies.Clear();
+
+            foreach (var cidr in trustedProxyCidrs)
+            {
+                if (!TryParseCidr(cidr, out var network))
+                    throw new InvalidOperationException($"Invalid ForwardedHeaders:TrustedProxyCidrs entry '{cidr}'. Use CIDR notation, e.g. '10.0.0.0/8'.");
+
+                options.KnownIPNetworks.Add(network);
+            }
+
+            foreach (var proxy in trustedProxies)
+            {
+                if (!IPAddress.TryParse(proxy, out var proxyAddress))
+                    throw new InvalidOperationException($"Invalid ForwardedHeaders:TrustedProxies entry '{proxy}'. Use a valid IP address.");
+
+                options.KnownProxies.Add(proxyAddress);
+            }
+        });
+    }
+
+    private static bool TryParseCidr(string cidr, out System.Net.IPNetwork network)
+    {
+        network = default!;
+        if (string.IsNullOrWhiteSpace(cidr))
+            return false;
+
+        string[] parts = cidr.Split('/', 2, StringSplitOptions.TrimEntries);
+        if (parts.Length != 2
+            || !IPAddress.TryParse(parts[0], out var networkAddress)
+            || !int.TryParse(parts[1], out var prefixLength))
+            return false;
+
+        int maxPrefixLength = networkAddress.AddressFamily switch
+        {
+            AddressFamily.InterNetwork => 32,
+            AddressFamily.InterNetworkV6 => 128,
+            _ => -1
+        };
+
+        if (maxPrefixLength < 0 || prefixLength < 0 || prefixLength > maxPrefixLength)
+            return false;
+
+        network = new System.Net.IPNetwork(networkAddress, prefixLength);
+        return true;
+    }
 }

EssentialCSharp.Web/Program.cs

@@ -107,17 +107,7 @@ private static void Main(string[] args)
 
 
 
-        builder.Services.Configure<ForwardedHeadersOptions>(options =>
-        {
-            options.ForwardedHeaders =
-                ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
-
-            // Only loopback proxies are allowed by default.
-            // Clear that restriction because forwarders are enabled by explicit 
-            // configuration.
-            options.KnownIPNetworks.Clear();
-            options.KnownProxies.Clear();
-        });
+        builder.Services.AddTrustedForwardedHeaders(builder.Configuration, builder.Environment);
 
         ConfigurationManager configuration = builder.Configuration;
         string connectionString = builder.Configuration.GetConnectionString("EssentialCSharpWebContextConnection") ?? throw new InvalidOperationException("Connection string 'EssentialCSharpWebContextConnection' not found.");
@@ -511,7 +501,7 @@ await McpJsonRpcResponseWriter.WriteErrorAsync(
         }
         app.UseStaticFiles();
 
-        app.UseRouting();
+        app.UseRouting();
 
         app.UseWhen(
             context => context.Request.Path.StartsWithSegments("/mcp"),
@@ -542,10 +532,10 @@ await McpJsonRpcResponseWriter.WriteErrorAsync(
                 await next(context);
             }));
 
-        app.UseRateLimiter();
-
-        app.UseAuthorization();
-        app.UseOutputCache();
+        app.UseRateLimiter();
+
+        app.UseAuthorization();
+        app.UseOutputCache();
 
         app.UseMiddleware<ReferralMiddleware>();
 
@@ -584,13 +574,13 @@ await McpJsonRpcResponseWriter.WriteErrorAsync(
         try
         {
             SitemapXmlHelpers.EnsureSitemapHealthy(siteMappingService.SiteMappings.ToList());
-            LogSitemapValidationSucceeded(logger);
-        }
-        catch (Exception ex)
-        {
-            LogSitemapValidationFailed(logger, ex);
-            // Continue startup even if sitemap validation fails
-        }
+            LogSitemapValidationSucceeded(logger);
+        }
+        catch (Exception ex)
+        {
+            LogSitemapValidationFailed(logger, ex);
+            // Continue startup even if sitemap validation fails
+        }
 
         app.Run();
     }
@@ -604,11 +594,11 @@ private static bool IsMcpTransportRequest(HttpRequest request) =>
     [LoggerMessage(Level = LogLevel.Error, Message = "Unhandled exception on {Path}")]
     private static partial void LogUnhandledException(ILogger<Program> logger, Exception? exception, PathString path);
 
-    [LoggerMessage(Level = LogLevel.Information, Message = "Sitemap validation completed successfully during application startup")]
-    private static partial void LogSitemapValidationSucceeded(ILogger<Program> logger);
-
-    [LoggerMessage(Level = LogLevel.Error, Message = "Failed to validate sitemap during application startup")]
-    private static partial void LogSitemapValidationFailed(ILogger<Program> logger, Exception exception);
+    [LoggerMessage(Level = LogLevel.Information, Message = "Sitemap validation completed successfully during application startup")]
+    private static partial void LogSitemapValidationSucceeded(ILogger<Program> logger);
+
+    [LoggerMessage(Level = LogLevel.Error, Message = "Failed to validate sitemap during application startup")]
+    private static partial void LogSitemapValidationFailed(ILogger<Program> logger, Exception exception);
 
     [LoggerMessage(Level = LogLevel.Warning, Message = "Ignoring invalid TryDotNet origin in CSP: {Origin}")]
     private static partial void LogIgnoringInvalidTryDotNetOrigin(ILogger logger, string origin);

EssentialCSharp.Web/appsettings.json

@@ -9,6 +9,10 @@
     }
   },
   "AllowedHosts": "*",
+  "ForwardedHeaders": {
+    "TrustedProxyCidrs": [],
+    "TrustedProxies": []
+  },
   "HCaptcha": {
     "SecretKey": "0x0000000000000000000000000000000000000000",
     "SiteKey": "10000000-ffff-ffff-ffff-000000000001"
@@ -47,4 +51,4 @@
   "TryDotNet": {
     "Origin": ""
   }
-}
+}