RequireHost and reverse proxy

[heggi]

My app has 2 gRPC services, one is for external requests with authentication and second for internal requests from other apps without any auth.

My app works in container, so I configure Kestrel for listen 80 and 88 ports (80 for internal requests and 88 for external) and add RequireHost to both services:

app.MapGrpcService<ExternalService>().RequireHost("*:88");
app.MapGrpcService<InternalService>().RequireHost("*:80");

My reverse proxy listens 443 port with ssl and proxing request as http to port 88 of my app, but nothing works...
If I change port in RequireHost to 80 - works again.

In debug I see this line:
[Microsoft.AspNetCore.Hosting.Diagnostics] Request starting HTTP/2 POST http://my.external.domain/ExternalService.Sample/Test application/grpc -
And I think that RequireHost uses port from this url (translated via forwarding headers) instead of actual Kestrel port.

How can I filter requests via actual Kestrel port?

[rafikiassumani-msft]

@heggi Have you had a chance to look at the following document? This might help with your proxy configurations. https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-6.0#forwarded-headers

@Tratcher any thoughts ?

Hi @heggi. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[Tratcher]

They're right that RequireHost works against the Host header. When using a reverse proxy that may be the public host/port and not the internal one.

What they need is a routing constraint that checks HttpContext.Connection.LocalPort. Do we have good docs on custom route constraints?

[heggi]

Yes you're right, I need a routing constraint that checks HttpContext.Connection.LocalPort
I can't find any docs for this

[rafikiassumani-msft]

@heggi The following doc has some basic examples of how to write custom route constraints: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/routing?view=aspnetcore-6.0#custom-route-constraints

Hi @heggi. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[heggi]

Hi @rafikiassumani-msft.
There is no way how to apply custom route constaints to whole controller, not to each action.
So I use gRPC, not MVC or WebApi Controller, and route attribute can't be applied to it.
Now I try to use MatcherPolicy as in RequireHost, but for local port.