From 1621088aa728d2ec7b2c71fe3638a73d914a8c03 Mon Sep 17 00:00:00 2001 From: maliming Date: Wed, 19 Aug 2026 19:42:06 +0800 Subject: [PATCH 1/3] Clarify known proxies configuration in forwarded headers document --- docs/en/deployment/forwarded-headers.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/en/deployment/forwarded-headers.md b/docs/en/deployment/forwarded-headers.md index 54abd43bfc..479ab45bd8 100644 --- a/docs/en/deployment/forwarded-headers.md +++ b/docs/en/deployment/forwarded-headers.md @@ -56,10 +56,14 @@ public override void ConfigureServices(ServiceConfigurationContext context) context.Services.Configure(options => { options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto; + options.KnownNetworks.Clear(); + options.KnownProxies.Clear(); }); } ``` +> `ForwardedHeadersOptions` trusts only loopback addresses out of the box: `KnownNetworks` contains `127.0.0.0/8` and `KnownProxies` contains the IPv6 loopback. When the reverse proxy connects from any other address, the middleware ignores the forwarded headers without raising an error and `HttpContext.Connection.RemoteIpAddress` keeps returning the address of the proxy. Clearing both lists as above is the usual choice for container and PaaS deployments, where the proxy address is assigned dynamically and the application is only reachable through that proxy. If the proxy has a stable address, add it to `KnownProxies` (or its network to `KnownNetworks`) instead of clearing the lists. Once both lists are empty the middleware stops checking who it received the request from, so it accepts `X-Forwarded-For` from anything that can reach the application. Only clear them when the application is not reachable except through the proxy, otherwise a caller that bypasses the proxy can spoof its client IP address. + 2. In the `OnApplicationInitialization` method of your module, add the middleware: > Forwarded Headers Middleware should run before other middleware. This ordering ensures that the middleware relying on forwarded headers information can consume the header values for processing. Forwarded Headers Middleware can run after diagnostics and error handling, but it must be run before calling UseHsts: From c82a1bf884ed48245f59f13ca0d8eb98bfb2bbea Mon Sep 17 00:00:00 2001 From: maliming Date: Fri, 28 Aug 2026 08:33:00 +0800 Subject: [PATCH 2/3] Upgrade MongoDB.Driver to 3.11.1 --- Directory.Packages.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 447399045d..bda9794bab 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -123,7 +123,7 @@ - + From 6868ba6aac5394b6869d789b322ccfcdcb37e7c5 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Fri, 28 Aug 2026 00:33:57 +0000 Subject: [PATCH 3/3] docs: update package version changes [skip ci] --- docs/en/package-version-changes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/package-version-changes.md b/docs/en/package-version-changes.md index 33fe09af0b..9da99ba9c3 100644 --- a/docs/en/package-version-changes.md +++ b/docs/en/package-version-changes.md @@ -13,7 +13,7 @@ |---------|-------------|-------------|-----| | AWSSDK.S3 | 4.0.7.2 | 4.0.102.3 | #26040 | | AWSSDK.SecurityToken | 4.0.2.2 | 4.0.100.10 | #26040 | -| MongoDB.Driver | 3.10.0 | 3.11.0 | #25979 | +| MongoDB.Driver | 3.10.0 | 3.11.1 | #25979, #26103 | ## 10.7.0-rc.2