Updated Dashboard to accept/map forwarded headers

[danespinosa]

Description

This change addresses the need to map the forwarded headers in the application when ASPNETCORE_FORWARDEDHEADERS_ENABLED is enabled. Currently even if a developer enables the ASPNETCORE_FORWARDEDHEADERS_ENABLED environment variable, the application does not map the forwarded headers properly because the application doesn't specify which headers to map.

Without this change the dashboard doesn't work well behind a reverse proxy like YARP when doing OpenID Auth since the app doesn't map the Host or Protocol (http/https) properly and the redirect ends up being the address YARP redirects the call to.

I need guidance for the test I was thinking calling the dashboard and do something similar to ValidateTokenMiddlewareTests to validate the Host, and Proto.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes, it assumes the developer knows that forwarding headers and mapping them is required for the dashboard to work properly when behind a reverse proxy like YARP. This in certain scenarios could pose a security risk, although it's documented that this dashboard shouldn't be used in production environments.
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Is this introducing a breaking change?
      • Yes
        • Link to aspire-docs issue (please use this breaking-change template):
      • No, if this change is accepted it would be good to clarify that the only 2 forwarded headers allowed are the Host and Protocol in here Configuration
        • Link to aspire-docs issue (please use this doc-idea template):
  • No

Microsoft Reviewers: Open in CodeFlow

[adamint]

@JamesNK @drewnoakes
I'm not sure whether there are any security implications here.

[davidfowl]

I’m that doesn’t seem right. Do you need to forward all headers?

[danespinosa]

I’m that doesn’t seem right. Do you need to forward all headers?

@davidfowl I just need XForwardedHost/X-Forwarded-Host that maps to host, that unblocks me to use Microsoft as an Identity provider, I wouldn't know if we need any other headers for other OpenId identity provider though, the other option would be to expose the ForwardedHeaderOptions via the config and let the users decide what headers to forward?

For example if a developer uses Yarp to cut the SSL connection at the edge they will need to map the Protocol too.

[danespinosa]

I’m that doesn’t seem right. Do you need to forward all headers?

@adamint @davidfowl i have limited the forwarded headers to host and protocol, let me know your thoughts.