Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: Sentry.Tunnel overwrites the X-Forwarded-For #4375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 25, 2025
Merged

fix: Sentry.Tunnel overwrites the X-Forwarded-For #4375

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
66c34a5
fix: Sentry.Tunnel overwrites the X-Forwarded-For
jamescrosswell Jul 22, 2025
db3b9ec
Update CHANGELOG.md
jamescrosswell Jul 22, 2025
27a2cd7
Merge branch 'main' into x-forward-for
jamescrosswell Jul 23, 2025
f413b79
Tidy tests
jamescrosswell Jul 24, 2025
b331224
Review feedback
jamescrosswell Jul 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

- Native AOT: don't load SentryNative on unsupported platforms ([#4347](https://github.com/getsentry/sentry-dotnet/pull/4347))
- Fixed issue introduced in release 5.12.0 that might prevent other middleware or user code from reading request bodies ([#4373](https://github.com/getsentry/sentry-dotnet/pull/4373))
- SentryTunnelMiddleware overwrites the X-Forwarded-For header ([#4375](https://github.com/getsentry/sentry-dotnet/pull/4375))

### Dependencies

Expand Down
25 changes: 22 additions & 3 deletions src/Sentry.AspNetCore/SentryTunnelMiddleware.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Primitives;
using Sentry.Internal.Extensions;

namespace Sentry.AspNetCore;
Expand Down Expand Up @@ -98,10 +99,9 @@ public async Task InvokeAsync(HttpContext context, RequestDelegate next)
Method = HttpMethod.Post,
Content = new StreamContent(memoryStream),
};
var clientIp = context.Connection?.RemoteIpAddress?.ToString();
if (clientIp != null)
if (CreateXForwardedForHeader(context) is { } forwardedFor)
{
sentryRequest.Headers.Add("X-Forwarded-For", context.Connection?.RemoteIpAddress?.ToString());
sentryRequest.Headers.Add("X-Forwarded-For", forwardedFor);
}
var responseMessage = await client.SendAsync(sentryRequest).ConfigureAwait(false);
// We send the response back to the client, whatever it was
Expand All @@ -122,6 +122,25 @@ public async Task InvokeAsync(HttpContext context, RequestDelegate next)
}
}

private static string? CreateXForwardedForHeader(HttpContext context)
{
var existingForwardedFor = context.Request.Headers["X-Forwarded-For"];
var clientIp = context.Connection?.RemoteIpAddress?.ToString();
if (clientIp is null)
{
return existingForwardedFor.Count > 0 ? existingForwardedFor.ToString() : null;
}

if (existingForwardedFor.Count == 0)
{
return clientIp;
}

return string.IsNullOrEmpty(existingForwardedFor)
? clientIp
: $"{existingForwardedFor}, {clientIp}";
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Header Malformation with Empty Values

The CreateXForwardedForHeader method malforms X-Forwarded-For headers when the incoming header contains only empty string values. This occurs because StringValues.ToString() returns a comma-only string (e.g., ',') for empty values, which string.IsNullOrEmpty() incorrectly evaluates as non-empty. This results in malformed headers like ', 192.168.1.1' or ', , 192.168.1.1' instead of only the client IP.

Locations (1)

Fix in Cursor • Fix in Web

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In context:

sentry-dotnet/src/Sentry.AspNetCore/SentryTunnelMiddleware.cs

Lines 134 to 141 in b331224

if (existingForwardedFor.Count == 0)
{
return clientIp;
}
return string.IsNullOrEmpty(existingForwardedFor)
? clientIp
: $"{existingForwardedFor}, {clientIp}";

So existingForwardedFor will never be empty when this codepath is executed.

}

private bool IsHostAllowed(string host) =>
host.EndsWith(".sentry.io", StringComparison.OrdinalIgnoreCase) ||
host.Equals("sentry.io", StringComparison.OrdinalIgnoreCase) ||
Expand Down
78 changes: 65 additions & 13 deletions test/Sentry.AspNetCore.Tests/Tunnel/IntegrationsTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.TestHost;
using Microsoft.Extensions.DependencyInjection;

Expand All @@ -9,6 +11,7 @@ public class IntegrationsTests : IDisposable
private readonly TestServer _server;
private HttpClient _httpClient;
private MockHttpMessageHandler _httpMessageHandler;
private const string FakeRequestIp = "192.168.200.200";

public IntegrationsTests()
{
Expand All @@ -22,7 +25,16 @@ public IntegrationsTests()
factory.CreateClient(Arg.Any<string>()).Returns(_httpClient);
s.AddSingleton(factory);
})
.Configure(app => { app.UseSentryTunneling(); });
.Configure(app =>
{
app.Use((context, next) =>
{
// The context doesn't get sent by TestServer automatically... so we fake a remote request here
context.Connection.RemoteIpAddress = IPAddress.Parse(FakeRequestIp);
return next();
});
app.UseSentryTunneling();
});
_server = new TestServer(builder);
}

Expand All @@ -35,9 +47,11 @@ public async Task TunnelMiddleware_CanForwardValidEnvelope(string host)
var requestMessage = new HttpRequestMessage(new HttpMethod("POST"), "/tunnel")
{
Content = new StringContent(
@"{""sent_at"":""2021-01-01T00:00:00.000Z"",""sdk"":{""name"":""sentry.javascript.browser"",""version"":""6.8.0""},""dsn"":""https://dns@" + host + @"/1""}
{""type"":""session""}
{""sid"":""fda00e933162466c849962eaea0cfaff""}")
$$"""
{"sent_at":"2021-01-01T00:00:00.000Z","sdk":{"name":"sentry.javascript.browser","version":"6.8.0"},"dsn":"https://dns@{{host}}/1"}
{"type":"session"}
{"sid":"fda00e933162466c849962eaea0cfaff"}
""")
};
await _server.CreateClient().SendAsync(requestMessage);

Expand All @@ -49,9 +63,12 @@ public async Task TunnelMiddleware_DoesNotForwardEnvelopeWithoutDsn()
{
var requestMessage = new HttpRequestMessage(new HttpMethod("POST"), "/tunnel")
{
Content = new StringContent(@"{}
{""type"":""session""}
{""sid"":""fda00e933162466c849962eaea0cfaff""}")
Content = new StringContent(
"""
{}
{"type":"session"}
{"sid":"fda00e933162466c849962eaea0cfaff"}
""")
};
await _server.CreateClient().SendAsync(requestMessage);

Expand All @@ -63,9 +80,11 @@ public async Task TunnelMiddleware_DoesNotForwardEnvelopeToArbitraryHost()
{
var requestMessage = new HttpRequestMessage(new HttpMethod("POST"), "/tunnel");
requestMessage.Content = new StringContent(
@"{""sent_at"":""2021-01-01T00:00:00.000Z"",""sdk"":{""name"":""sentry.javascript.browser"",""version"":""6.8.0""},""dsn"":""https://[email protected]/1""}
{""type"":""session""}
{""sid"":""fda00e933162466c849962eaea0cfaff""}");
"""
{"sent_at":"2021-01-01T00:00:00.000Z","sdk":{"name":"sentry.javascript.browser","version":"6.8.0"},"dsn":"https://[email protected]/1"}
{"type":"session"}
{"sid":"fda00e933162466c849962eaea0cfaff"}
""");
await _server.CreateClient().SendAsync(requestMessage);

Assert.Equal(0, _httpMessageHandler.NumberOfCalls);
Expand All @@ -77,13 +96,46 @@ public async Task TunnelMiddleware_CanForwardEnvelopeToWhiteListedHost()
var requestMessage = new HttpRequestMessage(new HttpMethod("POST"), "/tunnel")
{
Content = new StringContent(
@"{""sent_at"":""2021-01-01T00:00:00.000Z"",""sdk"":{""name"":""sentry.javascript.browser"",""version"":""6.8.0""},""dsn"":""https://[email protected]/1""}
{""type"":""session""}
{""sid"":""fda00e933162466c849962eaea0cfaff""}")
"""
{"sent_at":"2021-01-01T00:00:00.000Z","sdk":{"name":"sentry.javascript.browser","version":"6.8.0"},"dsn":"https://[email protected]/1"}
{"type":"session"}
{"sid":"fda00e933162466c849962eaea0cfaff"}
""")
};
await _server.CreateClient().SendAsync(requestMessage);

Assert.Equal(1, _httpMessageHandler.NumberOfCalls);
}

[Fact]
public async Task TunnelMiddleware_XForwardedFor_RetainsOriginIp()
{
// Arrange: Create a request with X-Forwarded-For header
var requestMessage = new HttpRequestMessage(new HttpMethod("POST"), "/tunnel")
{
Content = new StringContent(
"""
{"sent_at":"2021-01-01T00:00:00.000Z","sdk":{"name":"sentry.javascript.browser","version":"6.8.0"},"dsn":"https://[email protected]/1"}
{"type":"session"}
{"sid":"fda00e933162466c849962eaea0cfaff"}
""")
};
const string originalForwardedFor = "192.168.1.100, 10.0.0.1";
requestMessage.Headers.Add("X-Forwarded-For", originalForwardedFor);

// Act
await _server.CreateClient().SendAsync(requestMessage);

// Assert
Assert.Equal(1, _httpMessageHandler.NumberOfCalls);

var forwardedRequest = _httpMessageHandler.LastRequest;
Assert.NotNull(forwardedRequest);

Assert.True(forwardedRequest.Headers.Contains("X-Forwarded-For"));
var forwardedForHeader = forwardedRequest.Headers.GetValues("X-Forwarded-For").FirstOrDefault();
Assert.NotNull(forwardedForHeader);
forwardedForHeader.Should().Be($"{originalForwardedFor}, {FakeRequestIp}");
}

public void Dispose()
Expand Down
4 changes: 3 additions & 1 deletion test/Sentry.AspNetCore.Tests/Tunnel/MockHttpMessageHandler.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ public class MockHttpMessageHandler : DelegatingHandler

public string Input { get; private set; }
public int NumberOfCalls { get; private set; }
public HttpRequestMessage LastRequest { get; private set; }

public MockHttpMessageHandler(string response, HttpStatusCode statusCode)
{
Expand All @@ -18,9 +19,10 @@ protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage
CancellationToken cancellationToken)
{
NumberOfCalls++;
LastRequest = request;
if (request.Content != null) // Could be a GET-request without a body
{
Input = await request.Content.ReadAsStringAsync();
Input = await request.Content.ReadAsStringAsync(cancellationToken);
}
return new HttpResponseMessage
{
Expand Down
Loading