ASP.NET Core 8.0

Apply the C# 12 baseline first. These rules cover ASP.NET Core 8.0 hosting, middleware, endpoints, model binding, authentication, authorization, antiforgery, data protection, errors, and deployment. When ASP.NET Core Identity manages accounts, also apply the ASP.NET Core Identity 8.0 prompt for password hashing, lockout, security stamps, and recovery tokens.

Hosting and proxy boundaries

• Configure ForwardedHeadersOptions.ForwardedHeaders explicitly; its default is None, ForwardLimit is 1, and only loopback is trusted by default, so list trusted peers in KnownProxies or KnownNetworks and never accept forwarding headers from arbitrary peers.
• Do not set ForwardLimit = null unless KnownProxies or KnownNetworks still bounds the chain; discard client-supplied X-Forwarded-* values at the trusted edge before ASP.NET Core consumes them. Do not clear both trust lists or rely on ASPNETCORE_FORWARDEDHEADERS_ENABLED=true without restoring them. Never enable Microsoft.AspNetCore.HttpOverrides.IgnoreUnknownProxiesWithoutFor through runtimeconfig.json (including a RuntimeHostConfigurationOption in the project file), AppContext.SetSwitch, or the MICROSOFT_ASPNETCORE_HTTPOVERRIDES_IGNORE_UNKNOWN_PROXIES_WITHOUT_FOR environment variable; when XForwardedFor isn't processed, that switch makes the middleware accept the other forwarded headers from any peer. Check container, host, and platform environment settings for that variable.
• Set host-filtering AllowedHosts for Host and ForwardedHeadersOptions.AllowedHosts for X-Forwarded-Host to