Support disabling forwarded headers and cover proxy boundaries

Author: niemyjski

docs/forwarded-headers.md

@@ -19,7 +19,7 @@ This changes the previous trust-all behavior. Before upgrading a deployment behi
 
 Direct self-hosted installations do not need a proxy or additional configuration. `ForwardLimit: 1` is the maximum number of forwarded entries processed, not a minimum number of proxies required on each request. Requests without forwarded headers retain their connection IP and scheme. Multiple trusted proxies require a limit matching the intended chain and trust configuration for each traversed proxy.
 
-The current application configuration requires a positive integer. An explicit zero or negative limit prevents the middleware from initializing. This is stricter than ASP.NET Core itself: zero processes no forwarded entries, and a nullable limit can allow unlimited depth. This application does not currently expose the unlimited option. Supporting an explicit disabled mode or unlimited depth should be a separate, tested configuration decision; unlimited depth still requires restricted trusted peers.
+`ForwardLimit` defaults to `1`. Set it to `0` to disable forwarded-header processing, including headers from trusted proxies; requests retain the connection IP and scheme. Negative values are invalid and prevent the middleware from initializing. A positive value caps the number of entries processed, with processing also stopping at an unknown peer. This application requires a finite integer and does not expose ASP.NET Core's nullable/unlimited option. Direct self-hosters can leave the default unchanged or explicitly disable processing; deployments relying on a TLS-terminating proxy must keep processing enabled and configure their trusted peers.
 
 Forwarded headers run after exception/status-code handling and before HTTPS redirection, request logging, routing, MCP origin validation, authentication, and throttling. This lets downstream middleware use the validated client IP and scheme. Microsoft explicitly permits placement after diagnostics and error handling. See [Microsoft's proxy configuration guidance](https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-10.0).
 

src/Exceptionless.Web/Extensions/ForwardedHeadersConfiguration.cs

@@ -10,8 +10,8 @@ public static void Configure(ForwardedHeadersOptions options, IConfiguration con
         options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
         options.RequireHeaderSymmetry = false;
         options.ForwardLimit = configuration.GetValue("ForwardedHeaders:ForwardLimit", 1);
-        if (options.ForwardLimit is < 1)
-            throw new InvalidOperationException("ForwardedHeaders:ForwardLimit must be positive.");
+        if (options.ForwardLimit is < 0)
+            throw new InvalidOperationException("ForwardedHeaders:ForwardLimit must be zero or positive.");
 
         // Retain the framework's loopback defaults and add explicitly trusted ingress peers.
         foreach (string address in configuration.GetSection("ForwardedHeaders:KnownProxies").Get<string[]>() ?? [])

tests/Exceptionless.Tests/Extensions/ForwardedHeadersConfigurationTests.cs

@@ -12,13 +12,16 @@ namespace Exceptionless.Tests.Extensions;
 public sealed class ForwardedHeadersConfigurationTests
 {
     [Theory]
-    [InlineData(false, "198.51.100.20")]
-    [InlineData(true, "203.0.113.40")]
-    public async Task Invoke_ForwardedAddress_OnlyUsesConfiguredPeer(bool trusted, string expected)
+    [InlineData("192.0.2.10", "1", "198.51.100.20", "http")]
+    [InlineData("198.51.100.20", "1", "203.0.113.40", "https")]
+    [InlineData("198.51.100.20", "0", "198.51.100.20", "http")]
+    public async Task Invoke_ForwardedAddress_RespectsConfiguredPeerAndLimit(string trustedPeer, string limit, string expectedAddress, string expectedScheme)
     {
+        // Arrange
         var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
         {
-            ["ForwardedHeaders:KnownProxies:0"] = trusted ? "198.51.100.20" : "192.0.2.10"
+            ["ForwardedHeaders:KnownProxies:0"] = trustedPeer,
+            ["ForwardedHeaders:ForwardLimit"] = limit
         }).Build();
         var options = new ForwardedHeadersOptions();
         ForwardedHeadersConfiguration.Configure(options, configuration);
@@ -28,46 +31,106 @@ public async Task Invoke_ForwardedAddress_OnlyUsesConfiguredPeer(bool trusted, s
         context.Request.Headers["X-Forwarded-For"] = "203.0.113.40";
         context.Request.Headers["X-Forwarded-Proto"] = "https";
         var middleware = new ForwardedHeadersMiddleware(_ => Task.CompletedTask, NullLoggerFactory.Instance, Options.Create(options));
+
+        // Act
         await middleware.Invoke(context);
-        Assert.Equal(expected, context.Request.GetClientIpAddress());
-        Assert.Equal(trusted ? "https" : "http", context.Request.Scheme);
+
+        // Assert
+        Assert.Equal(expectedAddress, context.Request.GetClientIpAddress());
+        Assert.Equal(expectedScheme, context.Request.Scheme);
     }
 
-    [Fact]
-    public async Task Invoke_ForwardedChain_UsesConfiguredDepthAndStopsAtUnknownPeer()
+    [Theory]
+    [InlineData("1", "192.0.2.11")]
+    [InlineData("2", "203.0.113.40")]
+    [InlineData("3", "203.0.113.40")]
+    public async Task Invoke_ForwardedChain_UsesConfiguredDepthAndStopsAtUnknownPeer(string limit, string expectedAddress)
     {
+        // Arrange
         var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
         {
             ["ForwardedHeaders:KnownNetworks:0"] = "192.0.2.0/24",
-            ["ForwardedHeaders:ForwardLimit"] = "2"
+            ["ForwardedHeaders:ForwardLimit"] = limit
         }).Build();
         var options = new ForwardedHeadersOptions();
         ForwardedHeadersConfiguration.Configure(options, configuration);
         var context = new DefaultHttpContext();
         context.Connection.RemoteIpAddress = IPAddress.Parse("192.0.2.10");
         context.Request.Headers["X-Forwarded-For"] = "198.51.100.1, 203.0.113.40, 192.0.2.11";
         var middleware = new ForwardedHeadersMiddleware(_ => Task.CompletedTask, NullLoggerFactory.Instance, Options.Create(options));
+
+        // Act
+        await middleware.Invoke(context);
+
+        // Assert
+        Assert.Equal(expectedAddress, context.Request.GetClientIpAddress());
+    }
+
+    [Theory]
+    [InlineData("http")]
+    [InlineData("https")]
+    public async Task Invoke_DirectRequest_PreservesConnectionAddressAndScheme(string scheme)
+    {
+        // Arrange
+        var options = new ForwardedHeadersOptions();
+        ForwardedHeadersConfiguration.Configure(options, new ConfigurationBuilder().Build());
+        var context = new DefaultHttpContext();
+        context.Connection.RemoteIpAddress = IPAddress.Parse("203.0.113.40");
+        context.Request.Scheme = scheme;
+        var middleware = new ForwardedHeadersMiddleware(_ => Task.CompletedTask, NullLoggerFactory.Instance, Options.Create(options));
+
+        // Act
         await middleware.Invoke(context);
+
+        // Assert
         Assert.Equal("203.0.113.40", context.Request.GetClientIpAddress());
+        Assert.Equal(scheme, context.Request.Scheme);
+    }
+
+    [Fact]
+    public void Configure_NegativeForwardLimit_Throws()
+    {
+        // Arrange
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
+        {
+            ["ForwardedHeaders:ForwardLimit"] = "-1"
+        }).Build();
+
+        // Act
+        var exception = Assert.Throws<InvalidOperationException>(() => ForwardedHeadersConfiguration.Configure(new ForwardedHeadersOptions(), configuration));
+
+        // Assert
+        Assert.Contains("ForwardedHeaders:ForwardLimit", exception.Message, StringComparison.Ordinal);
     }
 
     [Theory]
     [InlineData("0.0.0.0/0")]
     [InlineData("::/0")]
     public void Configure_UnboundedTrustedNetwork_Throws(string network)
     {
+        // Arrange
         var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
         {
             ["ForwardedHeaders:KnownNetworks:0"] = network
         }).Build();
-        Assert.Throws<InvalidOperationException>(() => ForwardedHeadersConfiguration.Configure(new ForwardedHeadersOptions(), configuration));
+
+        // Act
+        var exception = Assert.Throws<InvalidOperationException>(() => ForwardedHeadersConfiguration.Configure(new ForwardedHeadersOptions(), configuration));
+
+        // Assert
+        Assert.Contains("ForwardedHeaders:KnownNetworks", exception.Message, StringComparison.Ordinal);
     }
 
     [Fact]
     public void Configure_Defaults_RetainsLoopbackTrustAndOneHopLimit()
     {
+        // Arrange
         var options = new ForwardedHeadersOptions();
+
+        // Act
         ForwardedHeadersConfiguration.Configure(options, new ConfigurationBuilder().Build());
+
+        // Assert
         Assert.NotEmpty(options.KnownProxies);
         Assert.NotEmpty(options.KnownIPNetworks);
         Assert.Equal(1, options.ForwardLimit);