UseForwardedHeadersForAzure

src/Api/Startup.cs

@@ -150,6 +150,12 @@ namespace Bit.Api
                 })
                 .AddDebug();
 
+            // Forwarded headers
+            if(!env.IsDevelopment())
+            {
+                app.UseForwardedHeadersForAzure();
+            }
+
             // Rate limiting
             app.UseMiddleware<CustomIpRateLimitMiddleware>();
 
@@ -173,7 +179,7 @@ namespace Bit.Api
             app.UseMvc();
         }
 
-        private IdentityServerAuthenticationOptions GetIdentityOptions(IHostingEnvironment env, 
+        private IdentityServerAuthenticationOptions GetIdentityOptions(IHostingEnvironment env,
             string authority, string suffix)
         {
             var options = new IdentityServerAuthenticationOptions

src/Billing/Startup.cs

@@ -10,6 +10,7 @@ using Bit.Core.Utilities;
 using Serilog.Events;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.AspNetCore.HttpOverrides;
 
 namespace Bit.Billing
 {
@@ -69,6 +70,12 @@ namespace Bit.Billing
                 app.UseDeveloperExceptionPage();
             }
 
+            // Forwarded headers
+            if(!env.IsDevelopment())
+            {
+                app.UseForwardedHeadersForAzure();
+            }
+
             app.UseMvc();
         }
     }

src/Core/Core.csproj

@@ -44,6 +44,7 @@
     <PackageReference Include="IdentityServer4" Version="1.3.1" />
     <PackageReference Include="IdentityServer4.AspNetIdentity" Version="1.0.1" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection.AzureStorage" Version="1.0.2" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpOverrides" Version="1.1.2" />
     <PackageReference Include="Microsoft.AspNetCore.Identity" Version="1.1.2" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="1.1.2" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="1.1.3" />

src/Core/Utilities/ServiceCollectionExtensions.cs

@@ -8,8 +8,10 @@ using IdentityModel;
 using IdentityServer4.Services;
 using IdentityServer4.Stores;
 using IdentityServer4.Validation;
+using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
@@ -170,5 +172,20 @@ namespace Bit.Core.Utilities
             services.AddSingleton(s => globalSettings);
             return globalSettings;
         }
+
+        public static void UseForwardedHeadersForAzure(this IApplicationBuilder app)
+        {
+            // ref: https://github.com/aspnet/Docs/issues/2384
+            var forwardOptions = new ForwardedHeadersOptions
+            {
+                ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto,
+                RequireHeaderSymmetry = false
+            };
+
+            forwardOptions.KnownNetworks.Clear();
+            forwardOptions.KnownProxies.Clear();
+
+            app.UseForwardedHeaders(forwardOptions);
+        }
     }
 }

src/Identity/Startup.cs

@@ -7,6 +7,7 @@ using Microsoft.Extensions.Configuration;
 using Bit.Core;
 using Bit.Core.Utilities;
 using Serilog.Events;
+using Microsoft.AspNetCore.HttpOverrides;
 
 namespace Bit.Identity
 {
@@ -72,6 +73,12 @@ namespace Bit.Identity
                 .AddConsole()
                 .AddDebug();
 
+            // Forwarded headers
+            if(!env.IsDevelopment())
+            {
+                app.UseForwardedHeadersForAzure();
+            }
+
             // Add IdentityServer to the request pipeline.
             app.UseIdentityServer();
         }