Asp.net Core 经过nginx代理后获取不到真实ip和scheme的问题

背景

我最近在一个Asp.net core Web 程序在经过nginx代理后 ，总是获取不到用户真实i和scheme（HttpContext.Request.Scheme），挠头；

我们一般从请求头获取用户ip:（我就用的这种

context.Request.Headers["X-Forwarded-For"]

当然这个时候要去你nginx要配置了 X-Forwarded-For

我们也可以用Forwarded Headers Middleware方式：

Request.HttpContext.Connection.RemoteIpAddress?.MapToIPv4().ToString();

当然按文档 ，在经过nginx代理后，我们是这样获取用户真实ip和scheme的：

  public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllersWithViews();
        services.Configure<ForwardedHeadersOptions>(options =>
        {
            options.ForwardedHeaders =
                ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
        });
    }

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseForwardedHeaders();

    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Home/Error");
        app.UseHsts();
    }

    //...
}

我虽然用的第一种从请求头中获取，但是Forwarded Headers Middleware 以上的这两步配置我都配置了。

后面看到dudu的，配置改为如下：

services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    //新增如下两行
    options.KnownNetworks.Clear();
    options.KnownProxies.Clear();

    //可以自定义这个头防止伪造X-Forwarded-For攻击，不过我觉得在第一层nginx那里配置 ：proxy_set_header X-Forwarded-For $remote_addr; 比较方便，具体不展开了大家自己搜下
    //options.ForwardedForHeaderName = "X-Forwarded-For-My-Custom-Header-Name";
});

安装dudu说法：

如果负载均衡不是在本机通过 Loopback 地址转发请求的，一定要加上 options.KnownNetworks.Clear 与 options.KnownProxies.Clear 的

下面我获取下加了 options.KnownNetworks.Clear(); options.KnownProxies.Clear();与不加，获取的请求头的区别大家有兴趣可以复制下来对比下

获取请求头的代码

访问链接：https://test.mydomain.com/GetRequestHeader

   [HttpGet]
        public IActionResult GetRequestHeader()
        {
            var Scheme = _httpContextAccessor.HttpContext.Request.Scheme;
            var RemoteIpAddress = _httpContextAccessor.HttpContext.Connection?.RemoteIpAddress;
            var RemotePort = _httpContextAccessor.HttpContext.Connection?.RemotePort;
            var Host = _httpContextAccessor.HttpContext.Request?.Host;
            var realip = _httpContextAccessor.HttpContext.RealIp();
            var header = _httpContextAccessor.HttpContext.Request.Headers.ToList();

            return Success("success", new { Scheme, RemoteIpAddress = RemoteIpAddress.ToString(), RemotePort = RemotePort.Value, Host = Host.Value, realip, header });
        }

加Clear()

{
    "status": 1,
    "msg": "success",
    "data": {
        "scheme": "https",
        "remoteIpAddress": "172.16.1.174",
        "remotePort": 0,
        "host": {
            "value": "test.mydomain.com",
            "hasValue": true,
            "host": "test.mydomain.com",
            "port": null
        },
        "realip": "172.16.1.174",
        "header": [
            {
                "Key": "Connection",
                "Value": [
                    "keep-alive"
                ]
            },
            {
                "Key": "Accept",
                "Value": [
                    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
                ]
            },
            {
                "Key": "Accept-Encoding",
                "Value": [
                    "gzip, deflate, br"
                ]
            },
            {
                "Key": "Accept-Language",
                "Value": [
                    "zh-CN,zh;q=0.9"
                ]
            },
            {
                "Key": "Host",
                "Value": [
                    "test.mydomain.com"
                ]
            },
            {
                "Key": "User-Agent",
                "Value": [
                    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36"
                ]
            },
            {
                "Key": "Upgrade-Insecure-Requests",
                "Value": [
                    "1"
                ]
            },
            {
                "Key": "X-Original-Proto",
                "Value": [
                    "http"
                ]
            },
            {
                "Key": "X-Forwarded-Host",
                "Value": [
                    "test.mydomain.com"
                ]
            },
            {
                "Key": "X-Forwarded-Port",
                "Value": [
                    "443"
                ]
            },
            {
                "Key": "X-Forwarded-Path",
                "Value": [
                    "/rest/api/login/test"
                ]
            },
            {
                "Key": "X-Real-IP",
                "Value": [
                    "172.16.1.174"
                ]
            },
            {
                "Key": "sec-ch-ua",
                "Value": [
                    "\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\""
                ]
            },
            {
                "Key": "sec-ch-ua-mobile",
                "Value": [
                    "?0"
                ]
            },
            {
                "Key": "sec-fetch-site",
                "Value": [
                    "none"
                ]
            },
            {
                "Key": "sec-fetch-mode",
                "Value": [
                    "navigate"
                ]
            },
            {
                "Key": "sec-fetch-user",
                "Value": [
                    "?1"
                ]
            },
            {
                "Key": "sec-fetch-dest",
                "Value": [
                    "document"
                ]
            },
            {
                "Key": "X-Original-For",
                "Value": [
                    "[::ffff:172.16.3.119]:53404"
                ]
            }
        ]
    }
}

不加Clear()

{
    "status": 1,
    "msg": "success",
    "data": {
        "scheme": "https",
        "remoteIpAddress": "::ffff:127.0.0.1",
        "remotePort": 52804,
        "host": {
            "value": "test.mydomain.com",
            "hasValue": true,
            "host": "test.mydomain.com",
            "port": null
        },
        "realip": "::ffff:127.0.0.1",
        "header": [
            {
                "Key": "Cache-Control",
                "Value": [
                    "max-age=0"
                ]
            },
            {
                "Key": "Connection",
                "Value": [
                    "close"
                ]
            },
            {
                "Key": "Accept",
                "Value": [
                    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
                ]
            },
            {
                "Key": "Accept-Encoding",
                "Value": [
                    "gzip, deflate, br"
                ]
            },
            {
                "Key": "Accept-Language",
                "Value": [
                    "zh-CN,zh;q=0.9"
                ]
            },
            {
                "Key": "Cookie",
                "Value": [
                    "_ga=GA1.2.1892895098.1524056233; _39wt_pk_cookie=d87f6237c18985a98db6aa79c0cdabb2-1015182643; _39wt_last_session_cookie=2b9b9210771666befc14a73de4951694-1544111121; _39wt_last_visit_time_cookie=1540012072376; __utma=202198739.1892895098.1524056233.1554648728.1563892800.3; __utrace=d145876b71944eb628f1c8b54da95a0e; money=0; picurl=https%253a%252f%252fpimg.39.net%252fupload%252fmy%252fc200844%252f20190313%252forg%252f7640674.jpg; pid=34820967; username=P52460069; DomainName=P52460069; nickname=%25e5%2593%2588%2A%2A%2A%2A%2A%2A; verify=3105499624; Hm_lvt_9840601cb51320c55bca4fa0f4949efe=1626704188; Hm_lvt_ab2e5965345c61109c5e97c34de8026a=1626704188"
                ]
            },
            {
                "Key": "Host",
                "Value": [
                    "test.mydomain.com"
                ]
            },
            {
                "Key": "User-Agent",
                "Value": [
                    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
                ]
            },
            {
                "Key": "Upgrade-Insecure-Requests",
                "Value": [
                    "1"
                ]
            },
            {
                "Key": "sec-ch-ua",
                "Value": [
                    "\" Not;A Brand\";v=\"99\", \"Google Chrome\";v=\"91\", \"Chromium\";v=\"91\""
                ]
            },
            {
                "Key": "sec-ch-ua-mobile",
                "Value": [
                    "?0"
                ]
            },
            {
                "Key": "Sec-Fetch-Site",
                "Value": [
                    "cross-site"
                ]
            },
            {
                "Key": "Sec-Fetch-Mode",
                "Value": [
                    "navigate"
                ]
            },
            {
                "Key": "Sec-Fetch-User",
                "Value": [
                    "?1"
                ]
            },
            {
                "Key": "Sec-Fetch-Dest",
                "Value": [
                    "document"
                ]
            },
            {
                "Key": "X-Original-For",
                "Value": [
                    "[::ffff:127.0.0.1]:52804"
                ]
            },
            {
                "Key": "X-Original-Proto",
                "Value": [
                    "http"
                ]
            }
        ]
    }
}

PS:注意本文请求都是经过nginx的情况下，且只有一层nginx；

引用

https://www.cnblogs.com/dudu/p/11088645.html

https://docs.microsoft.com/zh-cn/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-3.1