当原始请求为HTTPS时，AspNetCore.WsFederation获得Signin-WSFed重定向到HTTP

Question

上下文是一个在端口HTTP上的Docker容器中托管的aspnetcore 2.1网站，并且使用了仅暴露HTTPS 443的Nginx反向代理。

该网站可以从外部通过HTTPS访问，它可以重定向到HTTPS上的STS网站，该网站可以重定向到HTTPS上的/ signin-wsfed。

但是，/ signin-wsfed 的响应位置是HTTP。

这是请求：

POST https://core-mydocker.####/signin-wsfed HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, */*
Referer: https://sts-mydocker.####/Pages/Email/Default.aspx?wtrealm=https%3a%2f%2fcore-mydocker.####%2f&wa=wsignin1.0&wreply=https%3a%2f%2fcore-mydocker.####%2fsignin-wsfed&wctx=#####
Accept-Language: fr-FR,fr;q=0.8,en-GB;q=0.6,en;q=0.4,ja;q=0.2
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.2; WOW64; Trident/7.0)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: core-mydocker.####
Content-Length: 10612
Connection: Keep-Alive
Cache-Control: no-cache

和响应：

HTTP/1.1 302 Found
Server: nginx/1.12.2
Date: Thu, 21 Feb 2019 09:39:34 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: http://core-mydocker.####/Authenticate
Set-Cookie: .AspNetCore.Correlation.WsFederation.######=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; HTTPOnly; Securesignin-wsfed; httponly
Set-Cookie: FedAuth=#######=/; HTTPOnly; Secure; httponly
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://mydocker.####

从外部无法使用HTTP，这会引发错误。

考虑到早期请求（wtrealm，wreply等）中的每个参数都是HTTPS，Microsoft.AspNetCore.Authentication.WsFederation如何确定响应位置？

Answer 1

我可以找到此问题的解决方案，该问题与转发标头有关。

碰巧配置Nginx如下：

proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header        X-Forwarded-Proto $scheme;

然后按如下方式配置 ASPNET Core：

app.UseForwardedHeaders(new ForwardedHeadersOptions 
    { ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto }
    );

是不足够的。这篇文章中提供的解决方案原型标题不起作用

默认情况下，KnownNetworks 集合仅处理 127.0.0.1。在每个容器都位于单独 IP 上的 Docker 环境中，这肯定是不正确的，因此转发标头将被忽略。

根据经过验证的答案的建议，将代码更改为以下内容，解决了问题：

var forwardingOptions = new ForwardedHeadersOptions()
{
    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
};
forwardingOptions.KnownNetworks.Clear(); //its loopback by default
forwardingOptions.KnownProxies.Clear();
app.UseForwardedHeaders(forwardingOptions);