ASP.NET Core 10.0

Apply the C# 14 baseline first. When ASP.NET Core Identity manages accounts, also apply the ASP.NET Core Identity 10.0 prompt for password hashing, lockout, security stamps, and recovery tokens.

Hosting and proxy boundaries

• Configure ForwardedHeadersOptions.ForwardedHeaders explicitly; it defaults to None with ForwardLimit 1 and only loopback trusted, so list every KnownProxies entry or KnownIPNetworks range and never accept forwarding headers from arbitrary peers. KnownNetworks and Microsoft.AspNetCore.HttpOverrides.IPNetwork are obsolete in .NET 10 (ASPDEPR005).
• Don't set ASPNETCORE_FORWARDEDHEADERS_ENABLED=true (key ForwardedHeaders_Enabled) unless network policy guarantees only the trusted proxy reaches the app: the default host then enables XForwardedFor | XForwardedProto, inserts UseForwardedHeaders(), and clears KnownProxies and KnownIPNetworks, trusting any peer. Prefer Configure<ForwardedHeadersOptions> with the proxy addresses; if the flag is required, re-add them there, since that callback runs after the flag's setup.
• Never set ForwardLimit = null unless KnownProxies or KnownIPNetworks still bounds the chain, and discard client-supplied X-Forwarded-* values at the trusted edge.
• Set Host Filtering's AllowedHosts for direct hosts and ForwardedHeadersOptions.AllowedHosts for forwarded ones, and derive absolute URLs only after trusted proxy processing; never use an unvalidated Host, X-Forwarded-Host, or request scheme in redirects, reset links, cookie scope, or security decisions. Use LocalRedirect for