Server URLs in OpenAPI document are incorrect when application used with .NET Aspire

Is there an existing issue for this?

[X] I have searched the existing issues

Describe the bug

When an OpenAPI document is being used as part of an application running with .NET Aspire, the servers array of the OpenAPI document is populated with incorrect URLs.

This then causes operations using Swagger UI to fail:

In this case, the application is running on http://localhost:50000 and https://localhost:50001.

I think the issue is that headers such as X-Forwarded-For aren't being taken into account.

https://github.com/dotnet/aspnetcore/blob/08b60af1bca8cffff8ba0a72164fb7505ffe114d/src/OpenApi/src/Services/OpenApiDocumentService.cs#L190-L198

If I use my own transformer to always populate the server URLs, which uses the configured ForwardedHeadersOptions, then I get the correct host and port.

{
  "openapi": "3.0.1",
  "info": {
    "title": "London Travel",
    "description": "London Travel is an Amazon Alexa skill for checking the status for travel in London.",
    "termsOfService": "https://londontravel.martincostello.com/terms-of-service/",
    "contact": {
      "name": "Martin Costello",
      "url": "https://github.com/martincostello/alexa-london-travel-site"
    },
    "license": {
      "name": "Apache 2.0",
      "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
    },
    "version": ""
  },
  "servers": [
    {
      "url": "https://localhost:50001"
    }
  ]
}

If this is disabled and the built-in development-time support is used, the wrong URLs are rendered.

{
  "openapi": "3.0.1",
  "info": {
    "title": "London Travel",
    "description": "London Travel is an Amazon Alexa skill for checking the status for travel in London.",
    "termsOfService": "https://londontravel.martincostello.com/terms-of-service/",
    "contact": {
      "name": "Martin Costello",
      "url": "https://github.com/martincostello/alexa-london-travel-site"
    },
    "license": {
      "name": "Apache 2.0",
      "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
    },
    "version": ""
  },
  "servers": [
    {
      "url": "https://localhost:65076"
    },
    {
      "url": "http://localhost:65077"
    }
  ]
}

Expected Behavior

The correct URL(s) are included in the servers array of the OpenAPI document taking into account any HTTP forwarded headers.

Steps To Reproduce

Clone https://github.com/martincostello/alexa-london-travel-site/commit/23c2af944e9741ecbf192631261128af11db7258
Open the solution in Visual Studio
Launch the LondonTravel.Site.AppHost project
Wait for the applications to load
View the contents of the document at https://localhost:50001/openapi/api.json

Exceptions (if any)

No response

.NET Version

9.0.100-preview.7.24407.12

Anything else?

No response

@martincostello The transformer strategy is a good way to solve this problem.

A while back with modeled Swagger UI as an Aspire resource (https://github.com/davidfowl/AspireSwaggerUI/blob/146163aec403305770861098d3c16578a0d5dd99/SwaggerUi.Aspire.Hosting/SwaggerUiExtensions.cs) and configured forwarding for requests using Aspire's endpoint forwarding rules. In this approach, the Swagger UI is served outside the API resource instance and mimics a pattern similar to what we would do if we served an API testing UI in Aspire.

I'll stick this in the backlog for now as we evaluate how first class OpenAPI docs become in Aspire/Aspire dashboard. In the short-term, we can doc why this issue happens and how to resolve.

dotnet / aspnetcore