ASP.NET 6 部署于AWS Fargate搭配Network LB时Azure AD认证出现无限重定向循环问题求助

Hey there, let's break down why you're hitting that infinite redirect loop and how to fix it. The core issue here is a mix-up in middleware order and unnecessary manual scheme overriding that's conflicting with ASP.NET Core's built-in handling of forwarded headers from your NLB.

What's Going Wrong #

Your NLB terminates TLS on port 443 and forwards traffic to Fargate over HTTP (port 8080). ASP.NET Core relies on the ForwardedHeaders middleware to pick up the X-Forwarded-Proto header that NLB sends (which tells it the original request was HTTPS). But right now:

• You're manually forcing context.Request.Scheme = "https" before UseForwardedHeaders runs, which bypasses proper header handling
• This manual override clashes with UseHttpsRedirection, creating a loop where the app keeps trying to redirect to HTTPS even though the scheme is already forced

Step-by-Step Fixes #

1. Remove the Manual Scheme Override #

First, delete this custom middleware—it's causing more harm than good:

app.Use((context, next) => { 
    context.Request.Scheme = "https"; 
    return next(); 
});

2. Reorder Middleware to Prioritize Forwarded Headers #

The ForwardedHeaders middleware needs to run before any other middleware that checks the request scheme (like UseHttpsRedirection or auth). Here's the corrected order for your program.cs:

var app = builder.Build();

// First, handle forwarded headers from NLB
app.UseForwardedHeaders();

// Then handle environment-specific settings
if (!app.Environment.IsDevelopment()) { 
    app.UseExceptionHandler("/Error"); 
    app.UseHsts(); 
}

// UseHttpsRedirection will now correctly recognize the original HTTPS request from NLB
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.MapRazorPages();
app.MapControllers();
app.Run();

3. Verify NLB is Sending X-Forwarded-Proto #

AWS NLB automatically adds X-Forwarded-Proto: https for TLS listeners, but double-check your target group settings to make sure you haven't disabled header forwarding.

4. Confirm Azure AD Redirect URIs #

Make sure your Azure AD app's redirect URIs are using HTTPS, e.g., https://your-nlb-domain.com/signin-oidc—this should match the actual URL users are accessing.

Why This Works #

Once ForwardedHeaders runs first, it reads the X-Forwarded-Proto header from NLB and sets the request scheme to https automatically. This:

• Stops UseHttpsRedirection from triggering unnecessary redirects
• Ensures the Azure AD auth middleware generates HTTPS callback URIs, matching what you've configured in Azure AD and eliminating the loop

Extra Security Tip #

Instead of clearing KnownNetworks and KnownProxies entirely (which could leave you open to spoofed headers), add your NLB's IP range to the trusted list:

builder.Services.Configure<ForwardedHeadersOptions>(options => {
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    // Replace with your NLB/VPC's CIDR range
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("10.0.0.0"), 16));
});

内容的提问来源于stack exchange，提问作者Tolvin