Imo the recommendations given for port restriction in https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/health-checks?view=aspnetcore-7.0#require-host are unsafe. They rely solely on the Host header transmitted by the client. This header often is fully client controlled. E.g. if a host has an exposed port 80 and an internal management port 5001 which is not exposed to the internet with endpoints restricted by using .RequireHost("*:5001"), this can be trivially circumvented by doing something like curl --header "Host: whatever:5001" http://thepublicserver/healthz which connects on port 80 but stating port 5001 in the host header passing the RequireHost condition.

The linked https://learn.microsoft.com/en-us/aspnet/core/fundamentals/routing?view=aspnetcore-7.0#host-matching-in-routes-with-requirehost and the extension method documentation in https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.builder.routingendpointconventionbuilderextensions.requirehost?view=aspnetcore-7.0 also do not make it clear that this relies on the potentially user controlled Host header field.

I think I've seen this implementation pattern recommended in other locations in the documentation and samples where the goal is to restrict endpoints to a given port. At the very least there should be a warning, that this is generally not a safe way to achieve such a restriction. Ideally a safe pattern would be suggested. Even better would be having some built-in way to achieve this common requirement in a safe way and documenting that. E.g. some RequireLocalPort, RequireLocalHost etc. that actually checks the local port / local IP in the http context instead of the host header. It seems this was suggested in dotnet/aspnetcore#46057 which is now closed & locked, though I am not sure the security angle was given sufficient appreciation there.

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: c0cbb094-29e9-740a-9fd6-db372641d753
• Version Independent ID: 52d8efc9-a336-71d9-6d90-98173cbf6bf4
• Content: Health checks in ASP.NET Core
• Content Source: aspnetcore/host-and-deploy/health-checks.md
• Product: aspnet-core
• Technology: aspnetcore-hostdeploy
• GitHub Login: @Rick-Anderson
• Microsoft Alias: riande

Associated WorkItem - 98270