Forward authorized request inside controller/service #2045
-
|
Hello, I am developing a .Net Core 7 API which allows users to connect to WS Streams for specific cameras using YARP as a reverse proxy. I have implemented a proof of concept with Direct forwarding, but I am not impressed with the solution. var transformer = new CustomTransformer(); // or HttpTransformer.Default;
var requestOptions = new ForwarderRequestConfig { ActivityTimeout = TimeSpan.FromSeconds(100) };
app.MapForwarder("/camera/livestream/{**catch-all}", "127.0.0.1", requestOptions, transformer);
//// .... ////
private class CustomTransformer : HttpTransformer
{
public override async ValueTask TransformRequestAsync(HttpContext httpContext, HttpRequestMessage proxyRequest, string destinationPrefix)
{
// Copy all request headers
await base.TransformRequestAsync(httpContext, proxyRequest, destinationPrefix);
// Customize the query string:
var queryContext = new QueryTransformContext(httpContext.Request);
string sanitizedPath = httpContext.Request.Path.Value.Replace("/camera/livestream/", "/");
var stringSplit = sanitizedPath.Split('/', StringSplitOptions.RemoveEmptyEntries);
string finalPath = "";
for (int i = 0; i < stringSplit.Length; i++)
{
if (i > 0)
{
finalPath += "/" + stringSplit[i];
}
}
foreach (CameraService cameraService in CameraServiceCollection.Instance)
{
if (cameraService.Id.ToString() == stringSplit[0])
{
proxyRequest.RequestUri = RequestUtilities.MakeDestinationAddress($"http://{cameraService.URL}", finalPath, queryContext.QueryString);
using (var client = new HttpClient(new HttpClientHandler { Credentials = new NetworkCredential(cameraService.Username, cameraService.Password) }))
{
try
{
string url = $"http://{cameraService.URL}{finalPath}";
using (HttpResponseMessage response = await client.GetAsync(url, HttpCompletionOption.ResponseHeadersRead))
{
proxyRequest.Headers.Authorization = response.RequestMessage.Headers.Authorization;
}
}
catch (Exception ex) { }
}
}
}
proxyRequest.Headers.Host = null;
}
}This is the request that is caught by the MapForwarder and properly redirected The issues that I have with the above implementation is that it doesn't "fit" in the Controller/Service model. Because I am not registering it in the controller, I can't use the .Net Identity authentication to see if the request came from an User that has permission to receive the Camera stream, or should we deny the request ( That I could find ) I also have to register the destination IP to 127.0.0.1 because I do not know the amount of cameras that I would have to proxy too and they could change at runtime. ( I noticed it is possible to refresh the configuration at runtime ) Would it be possible to inject the YARP modules in API Controllers and upgrade to WS and proxy in them? That would be the cleanest solution in my opinion Very rough diagram of design |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 4 replies
-
|
You don't need MapForwarder, that's only for the simplest scenarios, you can call the IHttpForwarder directly from a normal controller. Most of that transform logic would move into the controller before invoking the forwarder, which addresses your question about 127.0.0.1.
This isn't relevant to direct forwarding, you're not reading anything here from config. |
Beta Was this translation helpful? Give feedback.
-
|
Hey, thank you for the swift reply. I actually got it working with the little nudge that you gave me. I used the same CustomTransformer as in the original post, but here is the API controller now. [Route("stream/{*path}")]
[HttpGet]
public async Task ForwarderHandler()
{
var httpClient = new HttpMessageInvoker(new HttpClientHandler()
{
UseProxy = false,
AllowAutoRedirect = false,
AutomaticDecompression = DecompressionMethods.All,
UseCookies = false,
});
var transformer = new CustomTransformer();
var requestConfig = new ForwarderRequestConfig { ActivityTimeout = TimeSpan.FromSeconds(100) };
// Destination prefix seems to be able to be anything but HTTPS?
var error = await _httpForwarder.SendAsync(HttpContext, "127.0.0.1",
httpClient, requestConfig, transformer);
// Check if the operation was successful
if (error != ForwarderError.None)
{
var errorFeature = HttpContext.GetForwarderErrorFeature();
var exception = errorFeature?.Exception;
}
}It upgrades to the websocket correctly. I did note that if you use "https://localhost:10001/Path/Base" or any HTTPS as shown in the Transforms example https://microsoft.github.io/reverse-proxy/articles/transforms.html , it first tries to do CONNECT instead of GET, so the WebSockets never connect. I am guessing because the initial request has to first establish HTTPS connection with the destination HTTPS destination prefix: HTTP destination prefix: One more question, but it is not that important or deal breaking. |
Beta Was this translation helpful? Give feedback.
-
|
Ah, when you use HTTPS it negotiates HTTP/2, and then attempts WebSockets over HTTP/2 (CONNECT). That's a new feature supported by YARP 2.0 and .NET 7. If that doesn't work it should retry and fall back to HTTP/1.1 (GET). Can you share the debug logs? I'm curious why that retry isn't working. You can also work around that by specifying version 1.1 in ForwarderRequestConfig (2.0 is the default). |
Beta Was this translation helpful? Give feedback.
-
The forwarder catches those exceptions and handles them as part of normal operations, you shouldn't need to do anything. |
Beta Was this translation helpful? Give feedback.
-
Yeah, that is my bad. It works correctly, I thought that the cameras had valid HTTPS certificates but they don't. So it did fallback to HTTP/1.1 but the certificate was invalid. Sorry for wasting your time on that. Thank you so much for the assistance and the guidance again. |
Beta Was this translation helpful? Give feedback.
You don't need MapForwarder, that's only for the simplest scenarios, you can call the IHttpForwarder directly from a normal controller. Most of that transform logic would move into the controller before invoking the forwarder, which addresses your question about 127.0.0.1.
This isn't relevant to direct forwarding, you're not reading anything here from config.