Host filtering with ASP.NET Core Kestrel web server
While Kestrel supports configuration based on prefixes such as http://example.com:5000
, Kestrel largely ignores the host name. Host localhost
is a special case used for binding to loopback addresses. Any host other than an explicit IP address binds to all public IP addresses. Host
headers aren't validated.
As a workaround, use Host Filtering Middleware. The middleware is added by CreateDefaultBuilder, which calls AddHostFiltering:
public class Program
{
public static void Main(string[] args)
{
CreateWebHostBuilder(args).Build().Run();
}
public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
WebHost.CreateDefaultBuilder(args)
.UseStartup<Startup>();
}
Host Filtering Middleware is disabled by default. To enable the middleware, define an AllowedHosts
key in appsettings.json
/appsettings.{Environment}.json
. The value is a semicolon-delimited list of host names without port numbers:
appsettings.json
:
{
"AllowedHosts": "example.com;localhost"
}
Note
Forwarded Headers Middleware also has an AllowedHosts option. Forwarded Headers Middleware and Host Filtering Middleware have similar functionality for different scenarios. Setting AllowedHosts
with Forwarded Headers Middleware is appropriate when the Host
header isn't preserved while forwarding requests with a reverse proxy server or load balancer. Setting AllowedHosts
with Host Filtering Middleware is appropriate when Kestrel is used as a public-facing edge server or when the Host
header is directly forwarded.
For more information on Forwarded Headers Middleware, see Configure ASP.NET Core to work with proxy servers and load balancers.
ASP.NET Core
Feedback
https://aka.ms/ContentUserFeedback.
Binnenkort: Gedurende 2024 worden GitHub Issues uitgefaseerd als het feedbackmechanisme voor inhoud. Dit wordt vervangen door een nieuw feedbacksysteem. Ga voor meer informatie naar:Feedback verzenden en bekijken voor