DamianH.Http.ForwardProxy 0.2.0

DamianH.Http.ForwardProxy

An HTTP forward (egress) proxy for ASP.NET Core and Kestrel on .NET 10. Clients configure it as their proxy (HTTPS_PROXY, HttpClient.Proxy, curl --proxy) to reach arbitrary destinations, subject to your authentication, authorization and destination rules.

• HTTP/1.1 CONNECT tunnels (connection middleware) and HTTP/2 CONNECT tunnels (RFC 9113 §8.5).
• Absolute-form http:// forwarding, including WebSocket upgrades. No reverse-proxy package dependency; the forwarding core is adapted from YARP (MIT, see THIRD-PARTY-NOTICES.txt).
• Proxy authentication through ASP.NET Core authentication handlers and authorization policies, with 407/Proxy-Authenticate. A ProxyBasic handler is included.
• Secure by default: only ports 443 (CONNECT) and 80 (http://), and private, loopback, link-local (cloud metadata) and other non-public addresses are blocked after DNS resolution, so DNS rebinding cannot bypass them.
• Optional TLS interception of selected CONNECT tunnels (HTTP/1.1 and HTTP/2) with your own certificate provider, so middleware or request transforms can modify requests, for example to inject credentials.
• Optional per-request upstream client-certificate selection for intercepted HTTPS requests, with certificate-isolated connection pooling for mTLS.
• RFC 9209 Proxy-Status errors, Via, logs, metrics and traces.

Installation

dotnet add package DamianH.Http.ForwardProxy

Quick start

using DamianH.Http.ForwardProxy;
using DamianH.Http.ForwardProxy.Authentication;
using Microsoft.AspNetCore.Authorization;

var builder = WebApplication.CreateBuilder(args);

builder.WebHost.ConfigureKestrel(kestrel => kestrel.ListenAnyIP(8080, listen =>
{
    listen.UseForwardProxy(); // HTTP/1.1 CONNECT
}));

builder.Services.AddAuthentication().AddProxyBasic(options =>
{
    options.ValidateCredentials = (context, user, password) => ValidateAsync(user, password);
});

builder.Services.AddForwardProxy(options =>
{
    options.AuthorizationPolicy = new AuthorizationPolicyBuilder(ProxyBasicDefaults.AuthenticationScheme)
        .RequireAuthenticatedUser()
        .Build();
});

var app = builder.Build();
app.UseForwardProxy(); // http:// forwarding and HTTP/2 CONNECT; before routing and auth middleware
app.MapGet("/healthz", () => "ok");
app.Run();

curl --proxy http://user:password@localhost:8080 https://example.com/

Without an authorization policy the proxy is open to anyone who can reach it and logs a warning at startup. Never expose an open proxy to the internet.

Documentation

• Overview and hosting
• Destination policy
• Authentication and authorization
• Errors and diagnostics
• TLS interception
• Deployment safety
• RFC coverage
• HTTP/1.1 conformance fixtures