Open
Description
Related to (#31374) @halter73 @benaadams @davidfowl
Kestrel has a fancy KnownHeaders collection for efficient handling of common request and response headers.
aspnetcore/src/Servers/Kestrel/shared/KnownHeaders.cs
Lines 16 to 31 in bc1ff6a
These lists have grown organically and should be revisited. We don't want to add too many entries since it makes the types consume more memory, but we do want to ensure most common headers are represented so we can avoid the slow path.
I've compared the current lists with headers customers have reported seeing in production. Here are some of the discrepancies:
| Seen in the wild: | Kestrel: | Notes |
|---|---|---|
| Allow | ||
| Authorization | ||
| Baggage | ||
| authority | ||
| bypass | ||
| cacheresponse | ||
| Client-IP | ||
| clientip | ||
| Content-Encoding | ||
| Content-Language | ||
| Content-Location | ||
| Content-MD5 | ||
| Content-Range | ||
| ContentType | ||
| E2EActivity | ||
| el_auth_param | ||
| Expires | ||
| Forwarded | https://tools.ietf.org/html/rfc7239 | |
| forwarded-for | ||
| gb-branch | ||
| gb-no-cache | ||
| guzzle-retry | ||
| From | Uncommon | |
| Grpc-Accept-Encoding | ||
| Grpc-Encoding | ||
| Grpc-Timeout | ||
| http_accept_language | ||
| If-Match | ||
| If-Modified-Since | ||
| If-None-Match | ||
| If-Range | ||
| If-Unmodified-Since | ||
| Keep-Alive | ||
| Last-Modified | ||
| LatencyPerfCounterName | ||
| Lcid | ||
| newrelic | ||
| OData-MaxVersion | ||
| OData-Version | ||
| okversion | ||
| postman-token | ||
| Proxy-Authorization | Kestrel rarely acts as a forward proxy | |
| Prefer | https://tools.ietf.org/html/rfc7240 | |
| Proxy-Connection | ||
| proxy-tool | ||
| Request-Context | ||
| Save-Data | ||
| sec-ch-ua | https://wicg.github.io/ua-client-hints/ | |
| Sec-Ch-Ua-Mobile | ||
| Sec-Fetch-Dest | https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-mode-header | |
| Sec-Fetch-Mode | ||
| Sec-Fetch-Site | ||
| sec-fetch-user | ||
| sec-gpc | https://globalprivacycontrol.github.io/gpc-spec/ | |
| Sec-GPC | ||
| sentry-trace | ||
| Soapaction | ||
| ssodisabled | ||
| Surrogate-Capability | ||
| transaction-id | ||
| Trailer | ||
| Translate | ||
| Upgrade | ||
| unique-id | ||
| Warning | ||
| X_CHAN | ||
| X_GLS | ||
| X_grg | ||
| X_sn | ||
| X_ts | ||
| X-ARR-LOG-ID | ||
| X-ARR-SSL | ||
| x-country-code | ||
| x-dt-no-cache | ||
| x-finder-tools | ||
| X-Forwarded-For | ||
| x-im-piez | ||
| X-IMForwards | ||
| X-IWS-Via | ||
| x-lgi-host | ||
| x-no-varnish | ||
| X-Original-URL | ||
| x-originating-ip | ||
| x-p2p-peerdist | ||
| x-p2p-peerdistex | ||
| X-ProxyUser-IP | ||
| x-remote-addr | ||
| x-remote-ip | ||
| X-Requested-With | ||
| x-serverselect | ||
| X-Trace | ||
| Xxpect |