ForwardedHeadersMiddleware applies headers added by a reverse proxy to the ASP.NET Core request context. It lets the application recognize the original client IP address and request scheme, even when the proxy communicates with the app over HTTP. section 27.3.2 section 28.4.2
The middleware commonly handles these deployment details:
- Reads X-Forwarded-For and updates the request’s client-address information. section 27.3.2
- Reads X-Forwarded-Proto and updates Request.Scheme so later middleware can recognize an originally HTTPS request as secure. section 27.3.2 section 28.4.2
- Runs before UseHttpsRedirection or UseHsts so those components receive the corrected scheme. section 28.4.2
- Enables automatically in a disabled state with WebApplicationBuilder, or activates through ASPNETCORE_FORWARDEDHEADERS_ENABLED=true. section 27.3.2 section 28.4.2
Configure forwarded headers before HTTPS handling
UseForwardedHeaders can be placed near the start of the pipeline and configured for the headers supplied by the proxy: ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto. Follow it with UseHttpsRedirection and UseRouting so both receive the corrected request details. section 27.3.2
IIS integration handles header forwarding automatically through its integration configuration. With NGINX, HAProxy, or another reverse proxy, enable the middleware explicitly or configure it manually. section 27.3.2 section 28.4.2
