.Net core X-Forwarded-Proto header doesn't pass to Nginx properly

Question

Sorry for the edit history but this issue was really unclear to me and it was difficult to locate the exact problem.

I have a .Net-Core web application that runs behind a Nginx and the X-Forwarded-Proto always passes http instead of https.

Startup.cs

 public void ConfigureServices(IServiceCollection services)
        {
            services.Configure<ForwardedHeadersOptions>(options =>
            {
                options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
            });

            services.AddMvc();

        }

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            //first middlewear
            app.UseForwardedHeaders();
             //and the rest
         }

Nginx conf

server {
    listen        80;
    server_name   example.com;
    location / {
        proxy_pass         http://localhost:5001/;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection keep-alive;
        proxy_set_header   Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

Nginx.conf

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    #cloudflare real ip
    #https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs-Logging-visitor-IP-addresses-with-mod-cloudflare-#12345681
    set_real_ip_from 173.245.48.0/20;
    real_ip_header    X-Forwarded-For;
    real_ip_recursive on;

    log_format  main  '"$scheme" $remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

access.log record

"http" 185.108.83.156 - - [03/Oct/2019:19:59:33 +0300] "GET /auth/signin/Facebook?returnUrl=%2F HTTP/1.1" 302 0 "https://example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36" "156"

as you can see the $scheme that I log is always HTTP.

A solution that solves the issue is to enforce Scheme to be HTTPS like so:

app.Use((context, next) =>
        {
            context.Request.Scheme = "https";
            return next();
        });

from https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-2.2#forwarded-headers-middleware-options

But with this solution I don't pass the headers and loses some information.

So does anyone have any solution for this case?

The code shown above works fine for me. According to the error info, I guess there's something wrong that makes your App cannot get the real https proto. So please make sure : 1. Did you enable the **`app.UseForwardedHeaders()`** **before** other middlewares? 2. Please invoke `nginx -T` to make sure you've enabled the proxy setting for headers like `proxy_set_header X-Forwarded-Proto $scheme;` 3. By the way, please change your app secrets as soon as possible. — itminus, Oct 03 '19 at 03:27
It doesn't allow me to flag it as a duplicate. However, it could be a possible duplicate of [this](https://stackoverflow.com/questions/37063685/facebook-oauth-the-domain-of-this-url-isnt-included-in-the-apps-domain) link — Shahzad Hassan, Oct 03 '19 at 08:00
@itminus this is not the real app secret. I enabled the `app.UseForwardedHeaders()` and nginx has `proxy_set_header X-Forwarded-Proto $scheme;` — Offir, Oct 03 '19 at 14:00
@itminus did you manage to do so in production environment and not just on localhost? — Offir, Oct 03 '19 at 14:01

score 2 · Answer 1 · answered Oct 05 '19 at 06:28

You're only running nginx on port 80 and without ssl, so, the $scheme variable will always be http. See http://nginx.org/r/$scheme.

If you care about https, it's probably a good idea to secure the connection between Cloudflare and your backend with HTTPS, too; this way, your $scheme variable will be populated correctly. Otherwise, you could also hardcode https in place of $scheme, but then it defeats the purpose of having a conditional test and a redirect on your real and final .Net backend.

score 2 · Accepted Answer · edited Oct 06 '19 at 03:28

Your Startup.cs file is fine but you didn't configure ssl for Kesterl.

You need to configure a X.509 ssl certificate for your .net core application

From https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-2.2#when-to-use-kestrel-with-a-reverse-proxy-1

Only the reverse proxy server requires an X.509 certificate, and that server can communicate with the app's servers on the internal network using plain HTTP

So in your case you have 7 main steps to do:
1) Get a SSL certificate from CloudFlare ORIGIN CA
2) Install the ssl certificate in your server
3) Create a PFX file so your Kesterl Server can read it.
4) Configure Kesterl https end points.
5) Modify your Nginx server to listen to port 443 and then redirect to Kestrel listening ports
6) Modify service files accordingly your configuration
7) Change Cloudflare to run Strict mode

Step 1 - Get ssl certificate from cloudflare:
Go to your dashboard at Cloudflare and choose SSL/TLS --> Origin Server -->Create Certificate. Follow the instructions and you will have 2 files at the end of the process: example.com.key example.com.pem

Step 2 - Place the files in your server at etc/ssl folder

Step 3 - Create PFX file so Kesterl can use the certificate:
run this at your server:

openssl pkcs12 -export -out example.pfx -inkey example.com.key -in example.com.pem

This will generate the example.pfx, place it in the same folder.

Step 4 - Configure Kesterl https end points.
From step 3 you should have got a password that you need to use at this step.
At your appsetting.json place this lines:

{
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  },
  "Kestrel": {
    "Endpoints": {
      "HTTPS": {
        "Url": "https://localhost:5001",
        "Certificate": {
          "Path": "/etc/ssl/example.pfx",
          "Password": "**********"
        }
      }
    }
  }

Step 5 - Configure your Nginx to listen on port 443 like so:

server {
    #listen        80;
    listen                 *:443 ssl;
    ssl_certificate        /etc/ssl/example.pem;
    ssl_certificate_key    /etc/ssl/example.key;
    server_name            example.com
    location / {
        proxy_pass         https://localhost:5001/;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection keep-alive;
        proxy_set_header   Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

Step 6 - configure your service file like so:

  [Unit]
    Description=example

    [Service]
    WorkingDirectory=/var/www/example
    ExecStart=/usr/bin/dotnet /var/www/example/exampleSite.dll
    Restart=always
    # Restart service after 10 seconds if the dotnet service crashes:
    RestartSec=10
    KillSignal=SIGINT
    SyslogIdentifier=example
    User=www-data
    Environment=ASPNETCORE_ENVIRONMENT=Staging
    Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false
    Environment=ASPNETCORE_HTTPS_PORT=5001
    Environment=ASPNETCORE_URLS=https://localhost:5001

    [Install]
    WantedBy=multi-user.target

Step 7 - Change Cloudflare at SSL/TLS to use Strict mode

Restart your application + Nginx and your server should now work like this:

Request --> Cloudflare(HTTPS) --> Nginx(HTTPS)-->Example.com

score 1 · Answer 3 · answered Oct 02 '19 at 07:06

Generally, the Headers of HTTP doesn't accept non-ASCII characters. Urls must be properly encoded when generated, the Redirect methods don't do it for you.

A quick fix could be to use the WebUtility.UrlEncode

using System.Net;
// ...
var encodedLocationName = WebUtility.UrlEncode(locationName);
return Redirect("~/locations/" + encodedLocationName);

score 0 · Answer 4 · answered Sep 30 '19 at 03:54

0

Please set appropriate character set in your nginx file.

Here is the documentation http://nginx.org/en/docs/http/ngx_http_charset_module.html#charset_types

answered Sep 30 '19 at 03:54

solvease

529
2
11

score 0 · Answer 5 · answered Oct 03 '19 at 18:07

This looks to be an issue with the way your NGinx file and Cloudflare is setup. From the config, you setup is

HTTPS->Cloudflare->HTTP->Your Server

This is why Scheme is always "http" in your nginx log. As Cloudflare is passing the request to your server over HTTP. You should have TLS setup between Cloudflare and you, which would enable port 443 on your nginx config, which would set the scheme as HTTPS. Forcing dotnet to beleive it was handled over HTTPS is not valid as Cloudflare is sending your clients data unencrypted over the public internet.

https://support.cloudflare.com/hc/en-us/articles/115000479507-Managing-Cloudflare-Origin-CA-certificates

Cloudflare's documentation lists how to set this up with NGinx.

.Net core X-Forwarded-Proto header doesn't pass to Nginx properly

5 Answers5