Unit test for Forwarded Headers Middleware

[claudiamurialdo]

Add a test for X-Forward headers and RemoteAddress function.

[genexusbot]

Cherry pick to beta success

• ca8045d

[genexusbot]

Cherry pick to beta success

• ce652c0

[ggallotti]

One minor concern about this is that always enabling XForwardedFor allows client spoofing. (anybody can fake their ip address just by sending this header), when the App is not deployed behind a Proxy (LoadBalancer).

So, Apps that are exposed directly to internet (not recommended) could "suffer" this Issue.

I think that it's ok, any secure webapp should be deployed behind a Proxy/LoadBalancer.

[claudiamurialdo]

One minor concern about this is that always enabling XForwardedFor allows client spoofing. (anybody can fake their ip address just by sending this header), when the App is not deployed behind a Proxy (LoadBalancer).

So, Apps that are exposed directly to internet (not recommended) could "suffer" this Issue.

I think that it's ok, any secure webapp should be deployed behind a Proxy/LoadBalancer.

You raise a valid concern about potential IP spoofing when enabling X-Forwarded-For headers without being deployed behind a proxy or load balancer.
No further changes are needed. As you found the middleware behavior can be controlled using the ASPNETCORE_FORWARDEDHEADERS_ENABLED environment variable.
The unit test has been updated to execute with the environment variable.

[genexusbot]

Cherry pick to beta success

• cb21473