ASP.NET Core 9.0

Use these rules for ASP.NET Core 9.0 applications targeting net9.0, after the included C# 13 baseline. Keep the .NET runtime and Microsoft.AspNetCore.App on the current 9.0 servicing release, and migrate before .NET 9 support ends on November 10, 2026. When ASP.NET Core Identity manages accounts, also apply the ASP.NET Core Identity 9.0 prompt for password hashing, lockout, security stamps, and recovery tokens.

Hosting, proxies, and transport

• Put internet-facing deployments behind a hardened reverse proxy, or explicitly configure Kestrel endpoints, certificates, protocols, request timeouts, MaxRequestBodySize, connection limits, and MaxConcurrentUpgradedConnections for the deployment's abuse budget rather than assuming defaults fit.
• Reject untrusted host names: configure top-level AllowedHosts for Host Filtering when Kestrel receives requests directly or a proxy preserves Host, and separately constrain ForwardedHeadersOptions.AllowedHosts when processing X-Forwarded-Host. Wildcard Kestrel bindings don't validate the Host header.
• Outside IIS integration, enable UseForwardedHeaders only with the exact ForwardedHeaders values required, a small ForwardLimit, and explicit KnownProxies or KnownNetworks, before HTTPS redirection, HSTS, authentication, link generation, rate-limit partitioning, and any code using scheme, host, or client IP.
• Preserve the ASP.NET Core 9.0.6 hardening that ignores all X-Forwarded-* values from unknown proxies. Never restore the old behavior by clearing both trust lists, setting