Redirect to Login wrong when running .NET Core 3.1 on Elastic Beanstalk

user_1574489 0
Viewed 320

I am deploying a .NET core 3.1 application to AWS Elastic Beanstalk.

My pipeline is HTTPS -> ALB -> HTTP -> Instance.

The problem I am facing is that when I require authentication, the redirect Location: header is http and absolute and the browser redirects incorrectly.

To resolve this, I need to either:

  • Make the Location: header relative, or
  • Get the Location: header to be https.

I am using app.UseForwardedHeaders() in my Startup.cs file as per Configure ASP.NET Core to work with proxy servers and load balancers, to try to make it https, but it still is http.

What needs to be done to get ASP.NET core Identity to work on Elastic Beanstalk?

amazon-elastic-beanstalk asp.net-core amazon-web-services c#
1 Answers

My problem was the configuration of the Microsoft.AspNetCore.HttpOverrides module.

By default, it was restricting KnownNetworks to 127.0.0.1 and KnownProxies to ::1. So when the request came from my ALB, it did not move the scheme from X-Forwarded-For to this.Request.Scheme.

The issue is resolved when I clear the networks and proxies during configuration, like this:

services.Configure<ForwardedHeadersOptions>(options =>
    {
        options.ForwardedHeaders =
            ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
        options.KnownNetworks.Clear(); // These are key
        options.KnownProxies.Clear();
    });

New Unknown:

Q: Is it safe to do this?

A: In my case, my EC2 instance is in a private subnet and my security group is restricting traffic to that from my ALB, so I feel pretty safe. But more research is required.

user_15744890
Related