Scope Forwarded Headers Trust to Known Subnet

[rvanmaanen]

Context

Program.cs (Web) currently calls KnownIPNetworks.Clear() and KnownProxies.Clear(), which trusts all sources for X-Forwarded-For headers. This is overly permissive.

Target State

Restrict forwarded-header trust to the Azure Container Apps internal subnet range only.

Implementation

1. Determine the Container Apps Environment internal CIDR (typically 10.0.0.0/16 or similar)
2. Instead of clearing the lists, add only that CIDR to KnownNetworks:

options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("10.0.0.0"), 16));

3. Make the CIDR configurable via appsettings.json for environment portability

Risk

Azure may rotate internal IPs — test thoroughly before deploying. The CIDR should be confirmed from the Container Apps Environment configuration.

Priority

Low