From 43bd727ddf31d812f187936185d5d5446b262c12 Mon Sep 17 00:00:00 2001
From: gunndabad <2041280+gunndabad@users.noreply.github.com>
Date: Wed, 11 Nov 2026 12:04:15 +0000
Subject: [PATCH 1/3] Set ASPNETCORE_FORWARDEDHEADERS_ENABLED in Docker image

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 content/Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/Dockerfile b/content/Dockerfile
index 969a10e..4b3b289 100644
--- a/content/Dockerfile
+++ b/content/Dockerfile
@@ -17,6 +17,7 @@ COPY --from=build /source/efbundle ./efbundle
 ENV SENTRY_RELEASE=${GIT_SHA}
 ENV GIT_SHA=${GIT_SHA}
 ENV ASPNETCORE_HTTP_PORTS=3000
+ENV ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
 
 USER $APP_UID
 

From 952591826f11d56963268a259b32efac3f4c836d Mon Sep 17 00:00:00 2001
From: gunndabad <2041280+gunndabad@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:29:52 +0000
Subject: [PATCH 2/3] Configure forwarded headers middleware in Program.cs

Replace the ASPNETCORE_FORWARDEDHEADERS_ENABLED environment variable in
the Docker image with explicit forwarded headers configuration.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 content/Dockerfile               |  1 -
 content/src/SDApp.Web/Program.cs | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/content/Dockerfile b/content/Dockerfile
index 4b3b289..969a10e 100644
--- a/content/Dockerfile
+++ b/content/Dockerfile
@@ -17,7 +17,6 @@ COPY --from=build /source/efbundle ./efbundle
 ENV SENTRY_RELEASE=${GIT_SHA}
 ENV GIT_SHA=${GIT_SHA}
 ENV ASPNETCORE_HTTP_PORTS=3000
-ENV ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
 
 USER $APP_UID
 
diff --git a/content/src/SDApp.Web/Program.cs b/content/src/SDApp.Web/Program.cs
index 33982e1..ace3717 100644
--- a/content/src/SDApp.Web/Program.cs
+++ b/content/src/SDApp.Web/Program.cs
@@ -1,5 +1,6 @@
 using GovUk.Frontend.AspNetCore;
 using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.HttpOverrides;
 using Prometheus;
 using SDApp.Web;
 using Serilog;
@@ -64,8 +65,23 @@
     options.CreateIfNotExists = true;
 });
 
+if (!builder.Environment.IsDevelopment())
+{
+    builder.Services.Configure<ForwardedHeadersOptions>(options =>
+    {
+        options.ForwardedHeaders = ForwardedHeaders.All;
+        options.KnownIPNetworks.Clear();
+        options.KnownProxies.Clear();
+    });
+}
+
 var app = builder.Build();
 
+if (!app.Environment.IsDevelopment())
+{
+    app.UseForwardedHeaders();
+}
+
 app.UseSerilogRequestLogging();
 
 if (app.Environment.IsDevelopment())

From c1dd4911f936f331156b48719920cba7da8d7723 Mon Sep 17 00:00:00 2001
From: gunndabad <2041280+gunndabad@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:31:49 +0000
Subject: [PATCH 3/3] Remove environment guard from forwarded headers config

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 content/src/SDApp.Web/Program.cs | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/content/src/SDApp.Web/Program.cs b/content/src/SDApp.Web/Program.cs
index ace3717..bdb1594 100644
--- a/content/src/SDApp.Web/Program.cs
+++ b/content/src/SDApp.Web/Program.cs
@@ -65,22 +65,16 @@
     options.CreateIfNotExists = true;
 });
 
-if (!builder.Environment.IsDevelopment())
+builder.Services.Configure<ForwardedHeadersOptions>(options =>
 {
-    builder.Services.Configure<ForwardedHeadersOptions>(options =>
-    {
-        options.ForwardedHeaders = ForwardedHeaders.All;
-        options.KnownIPNetworks.Clear();
-        options.KnownProxies.Clear();
-    });
-}
+    options.ForwardedHeaders = ForwardedHeaders.All;
+    options.KnownIPNetworks.Clear();
+    options.KnownProxies.Clear();
+});
 
 var app = builder.Build();
 
-if (!app.Environment.IsDevelopment())
-{
-    app.UseForwardedHeaders();
-}
+app.UseForwardedHeaders();
 
 app.UseSerilogRequestLogging();