dotnet / aspire

An opinionated, cloud ready stack for building observable, production ready, distributed applications in .NET
https://learn.microsoft.com/dotnet/aspire
MIT License
2.98k stars 280 forks source link

Https with YARP doesn't work for https and the ASP.NET Core Dev certificate #3991

Closed davidfowl closed 1 week ago

davidfowl commented 2 weeks ago

The ServiceDiscoveryDestinationResolver sets the host name to the original host in local dev scenarios and this results in a RemoteCertificateNameMismatch since the dev cert expects localhost as the domain name (for SNI).

This can be worked around by forcing the host name to be localhost in dev scenarios but that's not a great solution:

https://github.com/dotnet/aspire/issues/836#issuecomment-2075656462

cc @ReubenBond

ReubenBond commented 1 week ago
Original plan Plan: special case localhost * Change `ServiceDiscoveryDestinationResolver` logic so that if the service resolves to localhost, we *do not* set the Host property * Add an option to opt-out and always respect YARP's Host value In pseudocode: ```csharp if (IsLocalhost(resolvedAddress) && !options.AlwaysUseConfiguredHostValue) { result.Host = null; } else { result.Host = config.Host ?? originalUri.GetLeftPart(UriPartial.Authority); } ```

Plan: special case localhost

string? resolvedHost;
if (_yarpOptions.AlwaysUseConfiguredHostValue)
{
    // Always use the configured host value only.
    resolvedHost = originalConfig.Host;
}
else if (IsLocalhost(endpoint.EndPoint))
{
    // Suppress the host value for localhost
    resolvedHost = null;
}
else
{
    // Use the configured Host value if set and fall back to the authority from the input URI.
    resolvedHost = !string.IsNullOrWhiteSpace(originalConfig.Host) ? originalConfig.Host : originalUri.Authority;
}