The X-Forwarded-For header carries the original client’s IP address through a reverse proxy. Without it, the application sees the proxy’s address instead of the browser’s. section 27.3.2
ASP.NET Core can process forwarded headers with ForwardedHeadersMiddleware. Enable the middleware or configure it early so request properties reflect the forwarded request before dependent middleware runs. section 27.3.2
Listing 27.1 Configuring an app to use forwarded headers in Startup.cs
WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
WebApplication app = builder.Build();
app.UseForwardedHeaders(new ForwardedHeadersOptions #1
{
ForwardedHeaders = ForwardedHeaders.XForwardedFor | #2
ForwardedHeaders.XForwardedProto #2
});
app.UseHttpsRedirection(); #3
app.UseRouting(); #3
app.MapGet("/", () => "Hello world!");
app.Run();
Configure ASP.NET Core to process both X-Forwarded-For and X-Forwarded-Proto before HTTPS redirection and routing. section 27.3.2
