Class MiddlewareExtensions

Namespace

FishMMO.WebShared

Assembly

FishMMO-WebShared.dll

Extension methods for common ASP.NET middleware used across FishMMO web servers.

public static class MiddlewareExtensions

Inheritance

object

MiddlewareExtensions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

ConfigureTrustedProxies(ForwardedHeadersOptions, IConfiguration, IHostEnvironment)

Populates KnownProxies and KnownNetworks from configuration so the host only honours X-Forwarded-* headers from the local NGINX terminator. Without this, anyone reaching Kestrel directly can spoof their client IP and bypass per-IP rate limiting.

Config keys (any combination): ForwardedHeaders:KnownProxies — array of single IPs ("127.0.0.1") ForwardedHeaders:KnownNetworks — array of CIDR strings ("10.0.0.0/8") If both lists are empty the defaults (loopback) are kept.

public static void ConfigureTrustedProxies(ForwardedHeadersOptions options, IConfiguration configuration, IHostEnvironment environment)

Parameters

options ForwardedHeadersOptions

configuration IConfiguration

environment IHostEnvironment

GetClientIpKey(HttpContext)

Gets the client IP from the current HTTP context. RemoteIpAddress reflects X-Forwarded-For after UseForwardedHeaders runs. When IP is unresolvable (null), uses a hash of available identifying information (User-Agent + X-Forwarded-For) to spread requests across multiple rate-limit buckets instead of collapsing them into a single "unknown" bucket.

public static string GetClientIpKey(this HttpContext context)

Parameters

context HttpContext

Returns

string

UseFishMMOSecurityHeaders(IApplicationBuilder, IHostEnvironment, Action<IHeaderDictionary>?)

Adds security headers (HSTS, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy, Cross-Origin-Resource-Policy) to every response. In non-Production environments, also adds diagnostic headers (X-Server-Version, Server-Timing).

Use extraHeaders to add server-specific headers such as Content-Security-Policy, Cross-Origin-Opener-Policy, or Cross-Origin-Embedder-Policy that are only needed by certain hosts.

public static IApplicationBuilder UseFishMMOSecurityHeaders(this IApplicationBuilder app, IHostEnvironment environment, Action<IHeaderDictionary>? extraHeaders = null)

Parameters

app IApplicationBuilder

environment IHostEnvironment

extraHeaders Action<IHeaderDictionary>

Returns

IApplicationBuilder