Unable to obtain IP normally and forced to use https

[China-xiaoFang]

The following problems exist after using Ocelot.

1. Neither WebSocket nor basic HTTP requests can obtain the client's real IP address in the downstream service. However, the client's real IP address can be obtained normally in DelegatingHandler.
2. After deployment to IIS, https is used by default when forwarding downstream services. ("GlobalConfiguration:DownstreamScheme" has been configured but it still does not work.)

.NET version: v8
Ocelot version: v23.4.2
Deployment environment: Windows Server 2022 Datacenter (21H2)
IIS version: 10.0
Deployment method: An api site is deployed through IIS, all traffic is forwarded to this site, and then through the reverse proxy, it is proxied to the gateway center, that is, the Ocelot service, and then forwarded to various downstream services through Ocelot.

web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="wms-api" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*wms-api/*" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                    <action type="Rewrite" url="http://127.0.0.1:38090/wms-api/{R:2}" />
                </rule>
        </rewrite>
    </system.webServer>
</configuration>

Get client IP extension method

public static string RemoteIpv4(this HttpContext httpContext)
{
    if (httpContext == null)
        return string.Empty;

    var remoteIpv4 = string.Empty;

    if (httpContext.Request.Headers.TryGetValue("X-Real-IP", out var header1))
    {
        if (IPAddress.TryParse(header1, out var ipv4) && ipv4.AddressFamily == AddressFamily.InterNetwork)
        {
            remoteIpv4 = ipv4.ToString();
        }
    }

    if (httpContext.Request.Headers.TryGetValue("X-Forwarded-For", out var header2))
    {
        if (IPAddress.TryParse(header2, out var ipv4) && ipv4.AddressFamily == AddressFamily.InterNetwork)
        {
            remoteIpv4 = ipv4.ToString();
        }
    }

    if (string.IsNullOrEmpty(remoteIpv4))
    {
        var remoteIpAddress = httpContext.Connection.RemoteIpAddress;
        if (remoteIpAddress is {AddressFamily: AddressFamily.InterNetworkV6} && remoteIpAddress?.ToString() == "::1")
        {
            remoteIpv4 = "127.0.0.1";
        }
        else
        {
            remoteIpv4 = remoteIpAddress?.MapToIPv4()?.ToString();
        }
    }

    return remoteIpv4;
}

OcelotDelegatingHandler.cs

public class OcelotDelegatingHandler : DelegatingHandler
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public OcelotDelegatingHandler(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    /// <summary>Sends an HTTP request to the inner handler to send to the server as an asynchronous operation.</summary>
    /// <param name="request">The HTTP request message to send to the server.</param>
    /// <param name="cancellationToken">A cancellation token to cancel operation.</param>
    /// <exception cref="T:System.ArgumentNullException">The <paramref name="request" /> was <see langword="null" />.</exception>
    /// <returns>The task object representing the asynchronous operation.</returns>
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var httpContext = _httpContextAccessor.HttpContext!;

        // After publishing, for some reason, HTTPS will be used by default, so here we force to change HTTPS to HTTP
        request.RequestUri = new UriBuilder(request.RequestUri) {Scheme = "http"}.Uri;

        // Get the client IP address
        Console.WriteLine(httpContext.RemoteIpv4());
        // Here you can enter the client IP address normally

        return await base.SendAsync(request, cancellationToken);
    }
}

ocelot.json

{
  "Routes": [
    {
      "Key": "Gejia.Gateway.Center.API",
      "UpstreamPathTemplate": "/wms-api/ws/{url}",
      "DownstreamPathTemplate": "/{url}",
      "DownstreamScheme": "ws",
      "DownstreamHostAndPorts": [
        {
          "Host": "127.0.0.1",
          "Port": 38091
        }
      ]
    },
    {
      "Key": "Gejia.Gateway.Center.API",
      "UpstreamPathTemplate": "/wms-api/center/{url}",
      "DownstreamPathTemplate": "/{url}",
      "DownstreamHostAndPorts": [
        {
          "Host": "127.0.0.1",
          "Port": 38091
        }
      ]
    },
  ],
  "GlobalConfiguration": {
    "BaseUrl": "http://127.0.0.1:38090",
    "Timeout": 30000,
    "UpstreamHttpMethod": [ "Get", "Post", "Put", "Delete" ],
    "DownstreamScheme": "http",
    "AddHeadersToResponse": {
      "Content-Type": [ "application/javascript", "text/css", "text/html", "text/html" ]
    }
  }
}

[raman-m]

• X-Forwarded-For | Headers Transformation

[China-xiaoFang]

Can I put it in GlobalConfiguration? Or must it be put in a specific route?
I remember testing this parameter and it didn't seem to work.

[China-xiaoFang]

Yes, I tried to test it. Whether I put this parameter in the route or the global configuration, it still doesn't work. The IP obtained in the downstream WebSocket is still 127.0.0.1.

[raman-m]

Can I put it in GlobalConfiguration? Or must it be put in a specific route?

No! See → #1659, so the feat will be available in version 25, I guess. In current and next ver.24 the global feat will be unavailable.

[China-xiaoFang]

Thanks, I hope to see this change in v25.
But after my in-depth testing yesterday, WebSocket does not forward the X-Forwarded-For request header.

[China-xiaoFang]

No, I take it back. When I set UpstreamHeaderTransform correctly in Routes, I can get the client IP correctly at the API level.
But the client IP obtained in WebSocket is still 127.0.0.1.

[raman-m]

Yes, 127.0.0.1 IP is the localhost of the Docker container I guess 😉 🤣

[China-xiaoFang]

😄😂 Yes, But I saw that someone had raised issues before, and it was also the same that the client IP address could not be obtained in WebSocket.
I did not find the answer I wanted here.