2.15HttpContext Forwarding and Proxying

Created on Aug 17, 2026~12 min read

HttpContext forwarding refers to the process, within an ASP.NET Core application, of forwarding the contextual information of an HTTP request (including request headers, request content, query strings, response headers, response content, etc.) from one request to another internal request or service. This technique allows developers to redirect a request to another processing point without changing the client request, thereby implementing request proxying or routing functionality.

Use cases for HttpContext forwarding:

  • API Gateway pattern: Serves as the entry point for all external requests, routing requests to the correct backend services.
  • Load balancing and failover: Forwards requests to other available service instances to ensure system stability and reliability.
  • Request logging and auditing: Records request information to a logging system or auditing service to facilitate monitoring and debugging.
  • Security filtering and validation: Checks the authentication information and permissions of requests during forwarding to ensure their legitimacy.
  • A/B testing and blue-green deployment: Routes part of the traffic to a new version of the service to gradually validate new features.
  • Cross-origin request handling: Handles cross-origin requests to ensure they can be executed successfully.

Before using HttpContext for forwarding, make sure the following two steps have been completed:

  1. Register and enable the IHttpContextAccessor service.

In the Startup.cs or Program.cs file, register and enable the IHttpContextAccessor service, and configure the forwarding target whitelist.

cs
services.AddHttpContextAccessor();  // Not required when using the Furion framework (already injected by default)// Configure HttpContext forwarding options globallyservices.Configure<HttpContextForwardOptions>(options =>{    // The target host whitelist for forwarding; must be configured explicitly. If not configured or empty, any forwarding through the X-Forward-To header will be rejected    options.AllowedHosts = ["*"];   // "*" allows all hosts and protocols (high risk; recommended only in trusted environments)});

AllowedHosts whitelist rules in detail:

  • "furion.net" — Host name only; matches the default port (80/443) of any protocol (http/https).
  • "furion.net:8080" — Host + port; matches the specified port of any protocol.
  • "furion.net:*" — Host + port wildcard; matches any port under any protocol.
  • "https://furion.net" — Protocol + host; matches only the default port of the specified protocol.
  • "http://furion.net:8080" — Protocol + host + port; exact match.
  • "https://furion.net:*" — Protocol + host + port wildcard; matches only any port of the specified protocol.
  • "[::1]" — IPv6 host (wrapped in square brackets); matches the default port of any protocol.
  • "[::1]:8080" — IPv6 host + port; matches the specified port of any protocol.
  • "[::1]:*" — IPv6 host + port wildcard; matches any port under any protocol.
  • "http://[2001:db8::1]:8080" — Protocol + IPv6 host + port; exact match.
  • "*" — Global wildcard; allows any host and protocol (completely bypasses all host validation).
  1. Enable the request body buffering middleware to support repeated reading of the request content.
cs
app.UseEnableBuffering();
  1. (Optional) If a certificate error such as The SSL connection could not be established, see inner exception. occurs during forwarding, you can ignore SSL certificate validation by adding the following configuration:
cs
// Default client configurationservices.AddHttpClient(string.Empty)    .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler    {        // Ignore SSL certificate validation        ServerCertificateCustomValidationCallback = HttpRemoteUtility.IgnoreSslErrors,        SslProtocols = HttpRemoteUtility.AllSslProtocols    });// If using SocketsHttpHandler, you can ignore SSL certificate validation with the following configurationservices.AddHttpClient(string.Empty)    .ConfigurePrimaryHttpMessageHandler(() => new SocketsHttpHandler()    {        SslOptions = new SslClientAuthenticationOptions        {            // Ignore SSL certificate validation            RemoteCertificateValidationCallback = HttpRemoteUtility.IgnoreSocketSslErrors,            EnabledSslProtocols = HttpRemoteUtility.AllSslProtocols        },    });

The following is a simple example showing how to implement HttpContext forwarding in ASP.NET Core:

cs
[ApiController][Route("[controller]/[action]")]public class GetStartController(IHttpRemoteService httpRemoteService, IHttpContextAccessor httpContextAccessor) : ControllerBase{    // Forward proxy to a website    [HttpGet]    [ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)] // Disable browser caching    public Task<IActionResult?> ForwardToWebSite()    {        return httpContextAccessor.HttpContext.ForwardAsResultAsync("https://github.com");    }    // Forward proxy to an image    [HttpGet]    [ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)] // Disable browser caching    public Task<IActionResult?> ForwardToImage()    {        return httpContextAccessor.HttpContext.ForwardAsResultAsync(            "https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1u7RJI.img?w=584&h=326&m=6");    }    // Forward proxy to a download    [HttpGet]    [ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)] // Disable browser caching    public Task<IActionResult?> ForwardToDownload()    {        return httpContextAccessor.HttpContext.ForwardAsResultAsync(            "https://download.visualstudio.microsoft.com/download/pr/a17b907f-8457-45a8-90db-53f2665ee49e/49bccd33593ebceb2847674fe5fd768e/aspnetcore-runtime-8.0.10-win-x64.exe");    }    // Forward proxy to a form    [HttpPost]    public Task<YourRemoteFormResult?> ForwardToForm(int id, [FromForm] YourRemoteFormModel model)    {        return httpContextAccessor.HttpContext.ForwardAsAsync<YourRemoteFormResult>(            "https://localhost:7044/HttpRemote/AddForm");    }}

Through HttpContext forwarding, flexible request routing and processing mechanisms can be implemented in ASP.NET Core applications in combination with Middleware middleware technology, making it suitable for various application scenarios such as API Gateway, load balancing, request logging, security validation, and more.