部署在Kubernetes Pod的ASP.NET Core Web API生成HTTP而非HTTPS URL问题

问题场景 #

将ASP.NET Core Web API部署在Kubernetes Pod中，外部通过Ingress以HTTPS协议访问，但应用内通过HttpContext生成的URL始终为HTTP，导致返回给用户的URL不符合预期。环境细节：

• Web API运行在Kubernetes Pod内
• 依赖HttpContext生成URL
• HTTPS在Ingress层终止，内部请求为HTTP

已排查项（未解决问题） #

• Ingress的HTTPS与TLS终止配置正确
• 负载均衡器SSL/TLS终止配置合理
• 传入请求已携带X-Forwarded-Proto: https头
• 已在Startup.cs中添加ForwardedHeadersMiddleware，配置如下：

app.UseForwardedHeaders(new ForwardedHeadersOptions
{
    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
});

针对性解决步骤 #

1. 为ForwardedHeadersMiddleware配置信任IP/网段 #

默认情况下，ForwardedHeadersMiddleware仅信任本地回环地址，而Kubernetes中Ingress控制器的IP不在默认信任列表内，导致转发头被忽略。需明确添加集群内部IP或Ingress控制器IP到信任列表：

app.UseForwardedHeaders(new ForwardedHeadersOptions
{
    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto,
    // 根据你的Kubernetes集群实际IP段调整
    KnownProxies = { IPAddress.Parse("10.0.0.0/8") },
    KnownNetworks = { new IPNetwork(IPAddress.Parse("192.168.0.0"), 16) }
});

如果知道Ingress控制器的具体IP，直接添加到KnownProxies更精准。

2. 确保Ingress正确传递转发头 #

以NGINX Ingress为例，需通过注解开启转发头支持，避免头被过滤：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  name: api-ingress
spec:
  tls:
  - hosts:
    - your-domain.com
    secretName: api-tls-secret
  rules:
  - host: your-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

3. 调整中间件执行顺序 #

ForwardedHeadersMiddleware必须在UseRouting、UseAuthentication等核心中间件之前调用，否则无法修改HttpContext的协议信息：

// 正确顺序
app.UseForwardedHeaders();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
// ...其他中间件

4. 验证协议识别结果 #

添加测试接口确认HttpContext是否正确识别HTTPS：

[HttpGet("check-protocol")]
public IActionResult CheckProtocol()
{
    var currentScheme = HttpContext.Request.Scheme;
    var generatedUrl = Url.Action("CheckProtocol", "Home", null, currentScheme);
    return Ok(new { CurrentScheme = currentScheme, GeneratedUrl = generatedUrl });
}

调用接口后，若返回CurrentScheme: https，则说明问题已解决。

内容的提问来源于stack exchange，提问作者Hardik Dhuri