Surprising X-Forwarded-Prefix transform behavior

[brnls]

I have an asp.net core backend server with YARP in front. I am forwarding requests and stripping the path base when it forwards on. I am able to get it working but was confused on one bit.

IncomingHost:5000/backend1 -> DestinationHost:5001
IncomingHost:5000/backend2 -> DestinationHost:5002

new RouteConfig
{
    ClusterId = GetCluster(proxy.Path),
    RouteId = $"{proxy.Path}_route",
    Match = new RouteMatch
    {
        Path = $"/{proxy.Path}/{{**catchall}}",
        Hosts = new []
        {
            host
        }
    },
    Transforms = new List<Dictionary<string, string>> { }
}
.WithTransformPathRemovePrefix($"/{proxy.Path}")
.WithTransformRequestHeader("X-Forwarded-Prefix", $"/{proxy.Path}")
.WithTransformXForwarded()  // Why this is required?

Why is the WithTransformXForwarded required? If I don't provide it, the header is not sent. I understand I would use WithTransformXForwarded() if I wanted to set the header from the PathBase, but since I am setting it manually it seems unrelated and surprising that it is required.

Is this correct behavior? I may be misunderstanding correct usage of this API.

[benjaminpetit]

That's correct, if WithTransformXForwarded isn't called, all the X-Forwarded-* headers are stripped if present, and not added.

[brnls]

Okay, thanks for the reply.

[JamesFieldist]

This is way worse. The documentation states that the x-forwarded are added by default. They are as long as you do absolutely no transforms at all. Then, if you do, the x-forwarded are also not sent which breaks everything.

And there doesn't appear to be a global way to put back x-forwarded-*.

this:

    .AddTransforms(builderContext =>
    {
        builderContext.CopyRequestHeaders = true;
        builderContext.AddOriginalHost();
        builderContext.AddForwarded(removeAllXForwardedHeaders: false);
        builderContext.AddXForwarded(removeForwardedHeader: false);

Adds "forwarded" header which the segments ; separated, which asp.net core's middleware doesn't understand and is broken, and it adds x-original-* not x-forwarded-for despite using AddXForwarded, which asp.net core's middleware also doesn't understand.

further adding this:

        builderContext.AddRequestTransform(transformContext =>
        {
            var request = transformContext.ProxyRequest;
            var context = transformContext.HttpContext;

            // ✅ EXPLICITLY SET FORWARDED HEADERS (DO NOT TRUST AUTO-FORWARDING)
            request.Headers.Host = context.Request.Host.ToString();
            request.Headers.TryAddWithoutValidation(
                "X-Forwarded-For",
                context.Connection.RemoteIpAddress?.ToString()
            );
            request.Headers.TryAddWithoutValidation("X-Forwarded-Proto", context.Request.Scheme);
            request.Headers.TryAddWithoutValidation(
                "X-Forwarded-Host",
                context.Request.Host.ToString()
            );

            return new();
        });

Doesn't actually result in the asp.net core getting these request headers.

Which borks the entire thing.

Only doing this in your transforms in your json config:

      {
        "X-Forwarded": "Append",
        "HeaderPrefix": "X-Forwarded-"
      }

Actually works.

So the documentation is both wrong, and the behavior is broken. These should be ALWAYS sent unless explicilty turned off and just setting transforms to do things like strip a path shouldn't be breaking this.

[MihaZupan]

Can you share a minimal repro where you're seeing this?

and it adds x-original-* not x-forwarded-for despite using AddXForwarded

It does not. Nothing in YARP does "X-Original", unless you explicitly set that as the header prefix.
Where are you checking the received headers? Is another compoenent after YARP modifying these requests?

further adding this: ... Doesn't actually result in the asp.net core getting these request headers.

It should, please share a repro where you see it doesn't.

These should be ALWAYS sent unless explicilty turned off and just setting transforms to do things like strip a path shouldn't be breaking this.

That is the case. X-Forwarded- headers are added by default, unless you turn them off - either by opting into AddForwarded, or configuring X-Forwarded- yourself.