liveBook · Manning

Host filtering

As explained in ASP.NET Core in Action, 3e

Host filtering is the practice of restricting accepted host values to prevent untrusted hosts from influencing generated URLs or request handling.

Host filtering restricts accepted hostnames so untrusted host values cannot influence generated URLs or request handling. It becomes especially important when an ASP.NET Core application exposes Kestrel directly without a reverse proxy. section 27.4

Apply the practice according to the hosting arrangement:

  • Use host filtering when manually configuring the listening URL, exposing Kestrel to clients, or deploying behind infrastructure such as NGINX. section 27.4
  • Treat IIS reverse-proxy integration differently: IIS handles URL integration, so this specific manual URL setup is not required. section 27.4

How ASP.NET Core in Action, 3e covers it

How deep it goes
States the security rationale and hosting boundary but defers configuration details to separate guidance.
Examples
Contrasts direct Kestrel exposure and NGINX deployment with IIS reverse-proxy integration.
What you can do after
Operate/configure direct Kestrel deployments with hostnames restricted to those the application expects.
How it connects
Connects hostnames with Kestrel, reverse proxies, NGINX, IIS, and URL configuration.
Cover of ASP.NET Core in Action, 3e
liveBookmanning.com
Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.