Cannot seem to get the Yarp proxy config right for an api gateway (SSL error)

[sommmen]

Hiya,

I'm trying to create an api gateway for 3 c# asp net core projects with Yarp, but i'm failing to do so,

I can see the following errors;

When posting some json to the monitor service;

Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware: Debug: Failed to authenticate HTTPS connection.

System.Security.Authentication.AuthenticationException: Cannot determine the frame size or a corrupted frame was received.
   at System.Net.Security.SslStream.EnsureFullTlsFrameAsync[TIOAdapter](CancellationToken cancellationToken, Int32 estimatedSize)
   at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder`1.StateMachineBox`1.System.Threading.Tasks.Sources.IValueTaskSource<TResult>.GetResult(Int16 token)
   at System.Net.Security.SslStream.ReceiveHandshakeFrameAsync[TIOAdapter](CancellationToken cancellationToken)
   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware.OnConnectionAsync(ConnectionContext context)
Microsoft.AspNetCore.Server.Kestrel.Connections: Debug: Connection id "0HN2SCL6IQ9F1" stopped.
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets: Debug: Connection id "0HN2SCL6IQ9F1" sending FIN because: "The Socket transport's send loop completed gracefully."

When trying to access swagger:

Yarp.ReverseProxy.Forwarder.HttpForwarder: Information: Proxying to https://localhost:7088/swagger/index.html HTTP/2 RequestVersionOrLower 
null
Yarp.ReverseProxy.Forwarder.HttpForwarder: Warning: Request: An error was encountered before receiving a response.

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch

I can access all services fine via the browser. It also seems that the minionservice and the monitorservice can access eachother without issue. Only the api gateway fails. I must be doing something wrong, but i'm not sure what.

AppHost

builder.AddProject<Projects.WAW_Gateway>("gateway")
    .WithReference(monitorService)
    .WithReference(minionService)
    .WithReference(traceService)
    .WithExternalHttpEndpoints();

Gateway

string[] services = [
    "minion",
    "trace",
    "monitor",
];

var routeConfigs = services
    .Select(service =>
    {
        var prefix = $"/api/{service}";
        return new RouteConfig
            {
                RouteId = $"route-{service}",
                ClusterId = $"cluster-{service}",
                TimeoutPolicy = "Disable",
                Match = new RouteMatch
                {
                    // See: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/routing?view=aspnetcore-8.0#route-templates
                    Path = $"{prefix}/{{**catch-all}}",
                }
            }
            .WithTransformPathRemovePrefix(prefix);
    })
    .ToArray();

var clusterConfigs = services
    .Select(service => new ClusterConfig
    {
        ClusterId = $"cluster-{service}",
        Destinations = new Dictionary<string, DestinationConfig>(StringComparer.OrdinalIgnoreCase)
        {
            {
                $"dest-{service}", 
                new DestinationConfig
                {
                    Address = $"https://{service}service",
                    //Health =  $"https://{service}service/readiness"
                }
            }
        }
    })
    .ToArray();

var builder = WebApplication.CreateBuilder(args);

builder.AddServiceDefaults();

builder.Services.AddReverseProxy()
    .LoadFromMemory(routeConfigs, clusterConfigs)
    .AddServiceDiscoveryDestinationResolver();

builder.Services.AddHttpForwarderWithServiceDiscovery();

builder.Services.AddRateLimiter(rateLimiterOptions =>
{
    rateLimiterOptions.AddFixedWindowLimiter("fixed", options =>
    {
        options.Window = TimeSpan.FromSeconds(10);
        options.PermitLimit = 5;
    });
});

var app = builder.Build();

// Configure the HTTP request pipeline.

app.UseRateLimiter();

app.MapReverseProxy();

app.MapDefaultEndpoints();

app.Run();

If I change the routeconfig to use http rather than https, i can no reach swagger via the api gateway over https;
https://localhost:7156/api/monitor/swagger/index.html works
http://localhost:7156/api/monitor/swagger/index.html does not work

Posting some data however fails with the same error via http, but on https i see in the console:

Yarp.ReverseProxy.Forwarder.HttpForwarder: Information: Received HTTP/1.1 response 307.
Microsoft.AspNetCore.Routing.EndpointMiddleware: Information: Executed endpoint 'route-monitor'
Microsoft.AspNetCore.Server.Kestrel.Connections: Debug: Connection id "0HN2SCL6IQ9F2" completed keep alive response.
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request finished HTTP/1.1 POST https://localhost:7156/api/monitor/monitor - 307 0 - 481.2777ms
Microsoft.AspNetCore.Server.Kestrel.Connections: Debug: Connection id "0HN2SCL6IQ9F2" disconnecting.
Microsoft.AspNetCore.Server.Kestrel.Connections: Debug: Connection id "0HN2SCL6IQ9F2" stopped.
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets: Debug: Connection id "0HN2SCL6IQ9F2" sending FIN because: "The Socket transport's send loop completed gracefully."
Microsoft.AspNetCore.Server.Kestrel.Http2: Debug: Connection id "0HN2SCL6IQ9EM" is closing.
Microsoft.AspNetCore.Server.Kestrel.Http2: Debug: Connection id "0HN2SCL6IQ9EM" is closed. The last processed stream ID was 51.
Microsoft.AspNetCore.Server.Kestrel.Http2: Debug: The connection queue processing loop for 0HN2SCL6IQ9EM completed.
Microsoft.AspNetCore.Server.Kestrel.Connections: Debug: Connection id "0HN2SCL6IQ9EM" stopped.
Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets: Debug: Connection id "0HN2SCL6IQ9EM" sending FIN because: "The Socket transport's send loop completed gracefully."

Then curl respons shows:

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   262    0     0  100   262      0    526 --:--:-- --:--:-- --:--:--   526
  0     0    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0curl: (6) Could not resolve host: monitorservice

What am i missing here?

EDIT:

Adding .WithTransformUseOriginalHostHeader() helps and i can now post requests and reach the swagger file over https, http fails, but i think i should enable https redirection there anyways. I feel a bit conflicted because i'm not sure that this would be the right way to go about this.

[davidfowl]

So you have set of services all running on What OS? Do they all have https launch profiles?

[sommmen]

Windows, net8, latest aspire preview. They do have https launch profiles as is the default nowadays.
The services have https redirection, so i'm guessing the call gets pushed to the service, redirection ensues and then i get the hostmismatch issue on the certificate.

The services are pretty default setup asp net core minimal api setups;

Launch;

{
  "profiles": {
    "http": {
      "commandName": "Project",
      "launchBrowser": true,
      "launchUrl": "swagger",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      },
      "dotnetRunMessages": true,
      "applicationUrl": "http://localhost:5003"
    },
    "https": {
      "commandName": "Project",
      "launchBrowser": true,
      "launchUrl": "swagger",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      },
      "dotnetRunMessages": true,
      "applicationUrl": "https://localhost:7088;http://localhost:5003"
    },
    "IIS Express": {
      "commandName": "IISExpress",
      "launchBrowser": true,
      "launchUrl": "swagger",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    },
    "Container (Dockerfile)": {
      "commandName": "Docker",
      "launchBrowser": true,
      "launchUrl": "{Scheme}://{ServiceHost}:{ServicePort}/swagger",
      "environmentVariables": {
        "ASPNETCORE_HTTPS_PORTS": "8081",
        "ASPNETCORE_HTTP_PORTS": "8080"
      },
      "publishAllPorts": true,
      "useSSL": true
    }
  },
  "$schema": "http://json.schemastore.org/launchsettings.json",
  "iisSettings": {
    "windowsAuthentication": false,
    "anonymousAuthentication": true,
    "iisExpress": {
      "applicationUrl": "http://localhost:45014",
      "sslPort": 44382
    }
  }
}

Program;

var builder = WebApplication.CreateBuilder(args);

builder.AddServiceDefaults();

builder.Services.AddCarter();

builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

builder.Services.AddProblemDetails();

builder.Services.AddMediatR(config =>
{
    config.RegisterServicesFromAssembly(Assembly.GetAssembly(typeof(Program))!);
    config.AddOpenBehavior(typeof(ValidationBehavior<,>));
    config.AddOpenBehavior(typeof(LoggingBehavior<,>));
});

builder.Services.AddHttpClient<IMinionClient, MinionClient>(
    client => client.BaseAddress = new("http://minionservice"));

var app = builder.Build();

app.UseExceptionHandler();

app.UseSwagger();
app.UseSwaggerUI();

app.UseHttpsRedirection();

app.MapCarter(); // See: https://github.com/CarterCommunity/Carter

app.MapDefaultEndpoints();

app.Run();

I just now noticed my interservice connection happens via http not https.

I'm a bit confused as to why interservice communication would work but my yarp setup would not.
Would you like a small sample/repro project?