6.40HttpContextForwardOptions Configuration Options

Created on Aug 17, 2026~7 min read

The HttpContextForwardOptions type is specifically used to configure the forwarding behavior of HttpContext. You can register and configure this service in the project's Startup.cs or Program.cs file:

cs
// Register in the HttpRemote serviceservices.AddHttpRemote(builder => {})    .ConfigureForwardOptions(options =>  // .ConfigureForwardOptions((options, serviceProvider) =>    {        // Add custom configuration here    });// Register in servicesservices.Configure<HttpContextForwardOptions>(options =>{    // Add custom configuration here});

In addition, you can manually create an HttpContextForwardOptions instance and pass it in when forwarding:

cs
httpContext.ForwardAsResult("https://furion.net", forwardOptions: new HttpContextForwardOptions{    // Add custom configuration here});

The HttpContextForwardOptions contains the following properties:

  • Properties:
    • AllowedHosts: The allowlist of target hosts allowed for forwarding (type ICollection<string>?).
      Used to prevent Server-Side Request Forgery (SSRF) attacks. Forwarding is allowed only when the host of the target address (including port and protocol) matches one of the entries in the list.
      Supported formats (matching is case-insensitive):
      • "furion.net" – Hostname only; matches the default port (80/443) of any protocol (http/https).
      • "furion.net:8080" – Host + port; matches the specified port of any protocol.
      • "furion.net:*" – Host + port wildcard; matches any port under any protocol.
      • "https://furion.net" – Protocol + host; matches only the default port of the specified protocol.
      • "http://furion.net:8080" – Protocol + host + port; exact match.
      • "https://furion.net:*" – Protocol + host + port wildcard; matches any port of the specified protocol only.
      • "*" – Global wildcard; allows any host and protocol (completely bypasses validation, high risk).
        If not configured or empty, all target addresses specified via the X-Forward-To request header will be rejected to prevent unauthorized forwarding. Whenever possible, use exact rules and only open the wildcard to fully trusted sources.
    • WithQueryParameters: Whether to forward query parameters (URL parameters); default value is true (type bool).
    • WithRequestHeaders: Whether to forward request headers; default value is true (type bool).
    • WithResponseStatusCode: Whether to forward the response status code; default value is true (type bool).
    • WithResponseHeaders: Whether to forward response headers; default value is true (type bool).
    • WithResponseContentHeaders: Whether to forward response content headers; default value is true (type bool).
    • ResetHostRequestHeader: Whether to reset the Host request header; default value is false (type bool).
    • IgnoreQueryParameters: List of query parameters (URL parameters) to skip during forwarding (type string[]?).
    • IgnoreRequestHeaders: List of request headers to skip during forwarding (type string[]?).
    • IgnoreResponseHeaders: List of response headers to skip during forwarding (type string[]?).
    • OnForward: Used to perform custom operations before forwarding the response (type Action<HttpContext, HttpResponseMessage>).