diff --git a/Kubernetes/k8s-foxids-deployment.yaml b/Kubernetes/k8s-foxids-deployment.yaml index 3998275bf..a901cb038 100644 --- a/Kubernetes/k8s-foxids-deployment.yaml +++ b/Kubernetes/k8s-foxids-deployment.yaml @@ -87,6 +87,8 @@ spec: value: "http://+" - name: "Settings__UseHttp" value: "true" + - name: "Settings__TrustProxySchemeHeader" + value: "true" - name: "Settings__FoxIDsEndpoint" value: "https://id.itfoxtec.com" # change to your domain - https://id.my-domain.com - name: "Settings__FoxIDsBackendEndpoint" diff --git a/azuredeploy.json b/azuredeploy.json index 58b5121d4..66b5817b7 100644 --- a/azuredeploy.json +++ b/azuredeploy.json @@ -379,6 +379,7 @@ "DOCKER_ENABLE_CI": true, "ASPNETCORE_URLS": "http://+", "Settings__UseHttp": true, + "Settings__TrustProxySchemeHeader": true, "Settings__FoxIDsEndpoint": "[variables('foxidsSiteEndpoint')]", "Settings__FoxIDsControlEndpoint": "[variables('foxidsControlSiteEndpoint')]", "Settings__Options__Log": "ApplicationInsights", diff --git a/docs/reverse-proxy.md b/docs/reverse-proxy.md index 5ad6d8aa0..7108ee90c 100644 --- a/docs/reverse-proxy.md +++ b/docs/reverse-proxy.md @@ -57,7 +57,7 @@ The FoxIDs site support reading the [custom domain](custom-domain.md) (host name > The host header is only read if access is restricted by the `X-FoxIDs-Secret` HTTP header or the `Settings__TrustProxyHeaders` setting is set to `true`. -The FoxIDs site support to read the HTTP/HTTPS scheme if the `Settings__TrustProxySchemeHeader` setting is set to `true`. In the following HTTP headers in order of priority: +The FoxIDs site and FoxIDs Control site support to read the HTTP/HTTPS scheme if the `Settings__TrustProxySchemeHeader` setting is set to `true`. In the following HTTP headers in order of priority: 1. `X-Forwarded-Scheme` 2. `X-Forwarded-Proto` diff --git a/src/FoxIDs.Control/FoxIDs.Control.csproj b/src/FoxIDs.Control/FoxIDs.Control.csproj index 8e4e0d8d0..d5367d6b6 100644 --- a/src/FoxIDs.Control/FoxIDs.Control.csproj +++ b/src/FoxIDs.Control/FoxIDs.Control.csproj @@ -2,7 +2,7 @@ net8.0 - 1.4.15 + 1.4.16 FoxIDs Anders Revsgaard ITfoxtec diff --git a/src/FoxIDs.Control/Infrastructure/Hosting/ServiceCollectionExtensions.cs b/src/FoxIDs.Control/Infrastructure/Hosting/ServiceCollectionExtensions.cs index 6f6a886ed..5f1fe3358 100644 --- a/src/FoxIDs.Control/Infrastructure/Hosting/ServiceCollectionExtensions.cs +++ b/src/FoxIDs.Control/Infrastructure/Hosting/ServiceCollectionExtensions.cs @@ -153,7 +153,7 @@ public static IServiceCollection AddApiSwagger(this IServiceCollection services) In = ParameterLocation.Header, Type = SecuritySchemeType.ApiKey, Scheme = "Bearer", - BearerFormat = "JWT" + BearerFormat = "JWT" }); c.AddSecurityRequirement(new OpenApiSecurityRequirement { diff --git a/src/FoxIDs.ControlClient/FoxIDs.ControlClient.csproj b/src/FoxIDs.ControlClient/FoxIDs.ControlClient.csproj index d522765aa..7d3f8e690 100644 --- a/src/FoxIDs.ControlClient/FoxIDs.ControlClient.csproj +++ b/src/FoxIDs.ControlClient/FoxIDs.ControlClient.csproj @@ -2,7 +2,7 @@ net8.0 - 1.4.15 + 1.4.16 FoxIDs.Client Anders Revsgaard ITfoxtec diff --git a/src/FoxIDs.ControlShared/FoxIDs.ControlShared.csproj b/src/FoxIDs.ControlShared/FoxIDs.ControlShared.csproj index f3eeccd19..331099fd8 100644 --- a/src/FoxIDs.ControlShared/FoxIDs.ControlShared.csproj +++ b/src/FoxIDs.ControlShared/FoxIDs.ControlShared.csproj @@ -2,7 +2,7 @@ net8.0 - 1.4.15 + 1.4.16 FoxIDs Anders Revsgaard ITfoxtec diff --git a/src/FoxIDs.Shared/FoxIDs.Shared.csproj b/src/FoxIDs.Shared/FoxIDs.Shared.csproj index a629f597f..d06452bc5 100644 --- a/src/FoxIDs.Shared/FoxIDs.Shared.csproj +++ b/src/FoxIDs.Shared/FoxIDs.Shared.csproj @@ -2,7 +2,7 @@ net8.0 - 1.4.15 + 1.4.16 FoxIDs Anders Revsgaard ITfoxtec diff --git a/src/FoxIDs.Shared/Infrastructure/Hosting/ProxyHeadersMiddleware.cs b/src/FoxIDs.Shared/Infrastructure/Hosting/ProxyHeadersMiddleware.cs index 4d39e2188..458227065 100644 --- a/src/FoxIDs.Shared/Infrastructure/Hosting/ProxyHeadersMiddleware.cs +++ b/src/FoxIDs.Shared/Infrastructure/Hosting/ProxyHeadersMiddleware.cs @@ -22,6 +22,7 @@ public virtual async Task Invoke(HttpContext context) if (!(IsHealthCheck(context) || IsLoopback(context))) { ReadClientIp(context); + ReadSchemeFromHeader(context); _ = ValidateProxySecret(context); } @@ -85,5 +86,29 @@ protected void ReadClientIp(HttpContext context) } } } + + protected void ReadSchemeFromHeader(HttpContext context) + { + var settings = context.RequestServices.GetService(); + if (settings.TrustProxySchemeHeader) + { + string schemeHeader = context.Request.Headers["X-Forwarded-Scheme"]; + if (schemeHeader.IsNullOrWhiteSpace()) + { + schemeHeader = context.Request.Headers["X-Forwarded-Proto"]; + } + if (!schemeHeader.IsNullOrWhiteSpace()) + { + if (schemeHeader.Equals(Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase)) + { + context.Request.Scheme = Uri.UriSchemeHttp; + } + else if (schemeHeader.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase)) + { + context.Request.Scheme = Uri.UriSchemeHttps; + } + } + } + } } } diff --git a/src/FoxIDs.Shared/Models/Config/Settings.cs b/src/FoxIDs.Shared/Models/Config/Settings.cs index 183aac9d0..56c293002 100644 --- a/src/FoxIDs.Shared/Models/Config/Settings.cs +++ b/src/FoxIDs.Shared/Models/Config/Settings.cs @@ -80,6 +80,11 @@ public class Settings : IValidatableObject /// public string ProxySecret { get; set; } + /// + /// Optional trust proxy scheme header (HTTP/HTTPS). Default false. + /// + public bool TrustProxySchemeHeader { get; set; } + public virtual IEnumerable Validate(ValidationContext validationContext) { var results = new List(); diff --git a/src/FoxIDs.SharedBase/FoxIDs.SharedBase.csproj b/src/FoxIDs.SharedBase/FoxIDs.SharedBase.csproj index 3ce7bb5ac..d35e3e636 100644 --- a/src/FoxIDs.SharedBase/FoxIDs.SharedBase.csproj +++ b/src/FoxIDs.SharedBase/FoxIDs.SharedBase.csproj @@ -2,7 +2,7 @@ net8.0 - 1.4.15 + 1.4.16 FoxIDs Anders Revsgaard ITfoxtec diff --git a/src/FoxIDs/FoxIDs.csproj b/src/FoxIDs/FoxIDs.csproj index 8b78e7727..19e214e47 100644 --- a/src/FoxIDs/FoxIDs.csproj +++ b/src/FoxIDs/FoxIDs.csproj @@ -1,7 +1,7 @@  net8.0 - 1.4.15 + 1.4.16 FoxIDs Anders Revsgaard ITfoxtec diff --git a/src/FoxIDs/Infrastructure/Hosting/FoxIDsProxyHeadersMiddleware.cs b/src/FoxIDs/Infrastructure/Hosting/FoxIDsProxyHeadersMiddleware.cs index 43c09cda1..1c596d0d4 100644 --- a/src/FoxIDs/Infrastructure/Hosting/FoxIDsProxyHeadersMiddleware.cs +++ b/src/FoxIDs/Infrastructure/Hosting/FoxIDsProxyHeadersMiddleware.cs @@ -82,29 +82,5 @@ private string ReadHostFromHeader(HttpContext context) return string.Empty; } - - private void ReadSchemeFromHeader(HttpContext context) - { - var settings = context.RequestServices.GetService(); - if (settings.TrustProxySchemeHeader) - { - string schemeHeader = context.Request.Headers["X-Forwarded-Scheme"]; - if (schemeHeader.IsNullOrWhiteSpace()) - { - schemeHeader = context.Request.Headers["X-Forwarded-Proto"]; - } - if (!schemeHeader.IsNullOrWhiteSpace()) - { - if (schemeHeader.Equals(Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase)) - { - context.Request.Scheme = Uri.UriSchemeHttp; - } - else if(schemeHeader.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase)) - { - context.Request.Scheme = Uri.UriSchemeHttps; - } - } - } - } } } diff --git a/src/FoxIDs/Models/Config/FoxIDsSettings.cs b/src/FoxIDs/Models/Config/FoxIDsSettings.cs index c7e5b5261..2eca671fb 100644 --- a/src/FoxIDs/Models/Config/FoxIDsSettings.cs +++ b/src/FoxIDs/Models/Config/FoxIDsSettings.cs @@ -84,11 +84,6 @@ public class FoxIDsSettings : Settings /// public bool TrustProxyHeaders { get; set; } - /// - /// Optional trust proxy scheme header (HTTP/HTTPS). Default false. - /// - public bool TrustProxySchemeHeader { get; set; } - /// /// Read the HTTP request domain and use it as custom domain if configured on a tenant. ///