reverse-proxy

A toolkit for developing high-performance HTTP reverse proxy applications.

MIT License

Stars
8.4K
Committers
137
View Code on GitHub Visit Website View on X
Ecosystems: Playwright

Bot releases are hidden (Show)

reverse-proxy - 2.2.0 Latest Release

Published by MihaZupan about 2 months ago

This release supports .NET 6.0 and .NET 8.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • There are no breaking changes between YARP 2.2.0-preview.1 and 2.2.0.
  • See 2.2.0-preview.1 release notes for the list of breaking changes between YARP 2.1 and 2.2.

Other changes

  • The Forwarded transform now prefers the IPv4 form for dual-mode sockets (#2509 by @rkargMsft).
    • E.g. 127.0.0.1 is used instead of ::ffff:127.0.0.1.
    • A similar change was already made for X-Forwarded-For in 2.2.0-preview.1 (#2400).
  • Added a missing WebSocketCloseReason.ActivityTimeout enum value (#2571 by @MihaZupan).
  • Added a TlsFrameHelper.ParsingStatus API (#2587 by @wfurt).
    • This information can be used to distinguish between Invalid and Incomplete frames.
  • Removed one async state machine allocation when forwarding a request (#2586 by @MihaZupan).
  • Several documentation improvements.

New Contributors

For a full list of changes see here.

reverse-proxy - 2.2.0-Preview.1

Published by MihaZupan 5 months ago

This release supports .NET 6.0 and .NET 8.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • HeaderMatchMode.NotExists now also matches headers with an empty value (#2412 by @qianyuansun).
    • This makes NotExists exactly the opposite of Exists. Previously, empty values would not match either mode.
  • Errors triggered by the client disconnecting are now logged under a Debug severity (#2503 by @MihaZupan).
    • ForwarderError.RequestCanceled, RequestBodyCanceled, and UpgradeRequestCanceled are now logged under a new ILogger event with a Debug severity. Other errors continue to be logged under the existing event with a Warning severity.
    • How errors are mapped to different ForwarderErrors remains the same.

Other changes

  • Added support for Kestrel Start/Stop events on IKestrelTelemetryConsumer (#2360 by @ajay-sainy).
  • Added support for controlling OutputCachePolicy in the route configuration (#2328 by @witskeeper).
  • X-Forwarded-For now prefers the IPv4 form for dual-mode sockets (#2400 by @hacst).
    • E.g. 127.0.0.1 is used instead of ::ffff:127.0.0.1.
  • Fixed a bug where active health checks would consider new destinations as Healthy instead of Unknown (#2415 by @robbieknuth).
    • Destinations now remain as Unknown until enough health probes have been sent.
  • Added a new Query property to active health check configuration (#2421 by @robbieknuth).
    • Previously, only Path could have been specified, and ? would be escaped to %3F.
  • Added support to HttpSysDelegator for detaching from and re-initializing queues (#2426 by @NGloreous).
  • Fixed a race condition reliability bug in HttpSysDelegator (#2487 by @NGloreous).
  • OperationCanceledExceptions thrown by response transforms as part of error handling are now ignored (#2452 by @MihaZupan).
  • Fixed a bug where YARP validation of UseRequestTimeouts was too strict (#2501 by @MihaZupan).
  • Reduced the performance overhead of updating the activity timeout timer (#2475 by @MihaZupan).
  • Many documentation improvements.

New Contributors

For a full list of changes see here.

reverse-proxy - 2.1.0

Published by benjaminpetit 11 months ago

This release supports .NET 6.0, 7.0, and 8.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

What's Changed

New Contributors

Full Changelog: https://github.com/microsoft/reverse-proxy/compare/v2.1.0-preview.1...v2.1.0

reverse-proxy - 2.1.0-Preview.1

Published by benjaminpetit 11 months ago

This release supports .NET 6.0, 7.0, and 8.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

What's Changed

New Contributors

Pull Requests: query
Full Changelog: https://github.com/microsoft/reverse-proxy/compare/v2.0.0...v2.1.0-preview.1

reverse-proxy - 2.0.1 Security Patch

Published by Tratcher over 1 year ago

A security issue was identified in YARP 2.0.0. See Microsoft Security Advisory CVE-2023-33141.

The fix has been released and is available on NuGet.org.

reverse-proxy - 1.1.2 Security Patch

Published by Tratcher over 1 year ago

A security issue was identified in YARP 1.1.1 and lower. See Microsoft Security Advisory CVE-2023-33141.

The fix has been released and is available on NuGet.org.

reverse-proxy - 2.0.0

Published by MihaZupan over 1 year ago

This release supports .NET 6.0 and .NET 7.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • Existing HttpTransformer overloads that don't accept a CancellationToken have been marked as obsolete (#2016).
    • If you have created a custom class that derives from HttpTransformer, you should update the implementation to override the overloads which accept the CancellationToken instead.
    • Existing implementations that only override the obsolete overloads will continue working for the time being, but these overloads may be removed in a future major release.
  • See 2.0.0-RC.1 release notes for the rest of the breaking changes between YARP 1.1 and 2.0.

Other changes

  • Added a new enum value ForwarderError.RequestCreation that is reported if a request transform throws an exception (#2016).
  • Fixed a bug introduced in RC1 where custom response transform callbacks were not called on errors (when ProxyResponse is null) (#2016).
  • Fixed a bug where a request cancellation triggered by the manual CancellationToken (parameter to IHttpForwarder.SendAsync) was reported as RequestTimedOut instead of RequestCanceled (#2016).

For a full list of changes see here.

reverse-proxy - 2.0.0-RC.1

Published by MihaZupan over 1 year ago

This release supports .NET 6.0 and .NET 7.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • We dropped support for .NET Core 3.1 and .NET 5.0 as they are no longer supported.
    • YARP 2.0 targets .NET 6 and .NET 7.
  • The default session affinity policy has been changed from Cookie to HashCookie (#1989).
    • This policy provides fewer security guarantees about the protection level of the key data - the destination ids. On the other hand, it allows for multiple YARP instances to share session affinity cookies without the need to configure ASP.NET Core Data Protection.
    • For more details, see the Session Affinity documentation.
  • YARP now sets the SocketsHttpHandler.ConnectTimeout by default (#1991). You may observe different exceptions being reported by the proxy in failure scenarios when destination servers aren't responding. See #1678 for more context on this change.
  • The name of the enum value TlsHandshakeType.KeyEpdate has been corrected to KeyUpdate (#1614).

Major changes

  • Added support for WebSockets over HTTP/2 (#1978).
    • Protocol upgrades and downgrades are automatic. You can mix different protocol versions on both incoming and outgoing sides.
    • This feature is available on .NET 7.0 and newer only. To accept HTTP/2 WebSockets, you must use Kestrel.
    • See the YARP WebSockets documentation for more details.
  • Request transforms can now short-circuit requests and avoid proxying (#1923).
    • If you set the status code on the response to something other than 200 OK, or if you start writing to the response body, forwarding will be skipped.
    • See the Request Transforms documentation for more details.

Other changes

  • You can specify the RateLimiterPolicy on a route from the configuration (#1967). See the Rate Limiting documentation for more details.
  • You can specify the MaxRequestBodySize on a route from the configuration (#1947).
  • We exposed the InMemoryConfigProvider as a built-in API (#1732). You no longer have to copy the implementation from the samples :)
  • Added an IConfigChangeListener interface you can implement to receive notifications when and if configuration has been applied (#1734).
  • Added an IHttpForwarder.SendAsync overload that accepts a cancellation token (#1985).
  • Added async APIs to ISessionAffinityPolicy (#1990).
  • Added an overload of ReassignProxyRequest that also accepts a route (#1760).
  • Added a HeaderMatchMode.NotExists mode to header routing (#1806).
  • Added an AddMetricsConsumer helper method to make it easier to register a consumer with multiple IMetricsConsumers (#1899).
  • We report a warning early if you define multiple routes with the same ID (#1831).
  • We throw if you use a custom IForwarderHttpClientFactory and also call ConfigureHttpClient as the two are mutually exclusive (#1805).
  • We no longer restore the Upgrade response header unless there is a matching entry in the Connection header (#1731).
  • We remove the Content-Length: 0 header on responses that don't allow bodies (#1813).
  • We no longer proxy the Strict-Transport-Security header (#1984).

For a full list of changes see here.

reverse-proxy - 1.1.1

Published by Tratcher over 2 years ago

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Changes:

  • A fix for issue #1770 which was causing WebSockets to close abortively rather than gracefully.
reverse-proxy - 1.1.0

Published by Tratcher over 2 years ago

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Also see changes included in 1.1.0-rc1.

Breaking changes

Other changes

  • HTTP/3 support
  • Docs covering WebSockets, body transforms, IProxyConfigFilter, Let's Encrypt, WebProxy
  • Package readme's
  • Other doc and bug fixes

For a full list of changes see here.

reverse-proxy - 1.0.1 Security Patch

Published by MihaZupan over 2 years ago

A security issue was identified in how YARP 1.0.0 processes input. See Microsoft Security Advisory CVE-2022-26924.

The fix has been released and is available on NuGet.org.

reverse-proxy - 1.1.0-RC.1.22211.2 Security Patch

Published by MihaZupan over 2 years ago

A security issue was identified in how YARP 1.1.0-rc.1.22152.1 processes input. See Microsoft Security Advisory CVE-2022-26924.

The fix has been released and is available on NuGet.org.

reverse-proxy - 1.1.0-RC.1

Published by MihaZupan over 2 years ago

A security issue was identified in how this release of YARP processes input. Please update to 1.1.0-rc.1.22211.2.

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • We made a change to how distributed tracing headers are proxied, allowing for easier configuration of pass-through scenarios. #1533
    When using direct forwarding, you must now also configure the ActivityHeadersPropagator on the SocketsHttpHandler to match the default behavior of YARP 1.0: 
    new SocketsHttpHandler()
{
    // ...
+   ActivityHeadersPropagator = new ReverseProxyPropagator(DistributedContextPropagator.Current)
};

Other changes

  • Added support for multiple configuration sources. #1534
  • YARP will use zero-byte reads when proxying the request & response bodies, reducing the memory consumption of long-running requests by up to 6x when the runtime supports it. #1415
  • We are now using non-validated headers. This avoids subtle transformations/removals of header values, while avoiding many allocations and providing a significant performance improvement. #1507
  • Added an IProxyStateLookup interface, giving you real-time access to clusters and routes. Also added a ReassignProxyRequest extension method allowing you to change the cluster after routing has already run. These are the key building blocks for creating custom A/B testing and rolling upgrade systems. #1538
  • Added support for Http.Sys request delegation. #1556
  • You can now modify the request body within a request transform, as YARP won't capture the body before transforms run. #1569
  • YARP now throws if the request body length does not match the Content-Length header, providing a useful diagnostic when bodies are modified in-process without updating the headers. #1462
  • Fixed a bug where the cluster model wasn't updated on destination-only configuration changes. #1568
  • Added a static HttpTransformer.Empty field next to the existing HttpTransformer.Default for easy access to a transformer without the X-Forwarded-* and OriginalHost transforms. #1444
  • Made QueryTransformContext case-insensitive to match ASP.NET behavior. #1553

For a full list of changes see here.

reverse-proxy - 1.0.0

Published by MihaZupan almost 3 years ago

A security issue was identified in how this release of YARP processes input. Please update to 1.0.1.

We invite you to read the Announcing YARP 1.0 Release blog post.

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • When using the PathPattern transform, /{**remainder} has to be used instead of /{remainder} for the catch-all. This comes with a bug fix where the transform would incorrectly escape the / character as %2F in the remainder. #1321

Other changes

  • Fixed a bug with the RequestHeaderRemove transform where it could throw while processing requests. #1335
  • Fixed a narrow HTTP/2 scenario where the destination server responds with a NO_ERROR reset. #1320
  • A number of documentation and sample improvements. #1329, #1322, #1336, #1338, #1339, #1342, #1361, #1365

For a full list of changes see here.

reverse-proxy - 1.0.0-RC.1

Published by Tratcher almost 3 years ago

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

  • The Yarp.ReverseProxy.Telemetry.Consumption package was renamed to Yarp.Telemetry.Consumption. #1251
  • The Yarp.ReverseProxy.ServiceFabric nuget package is not included in this release. That work is moving to a different repo and development schedule. #1304
  • The ForwarderRequestConfig.Timeout request timeout has been replaced by an ActivityTimeout. The timeout now restarts when response headers are received, or when any request, response, or websocket data is transferred. WebSockets should enable Pings to keep idle connections alive. gRPC streams should consider using application level pings if they intend to remain idle longer than the timeout. #1289
  • The I*MetricsConsumer interfaces have been consolidated to IMetricsConsumer<T>. #1295
  • ActivityPropagationHandler and ActivityContextHeaders removed. This feature is now available natively in .NET 6. See the discussion for information on how to enable the scenario for prior versions of .NET. #1311
  • Response header and trailer transform APIs now take a ResponseCondition to allow them to run on Success, Failure, or Always. #1300
  • The HttpContext.GetClusterState extension method has been removed. #1166
  • IProxyConfigFilter.ConfigureRouteAsync now takes in ClusterConfig as well. #1231

Other changes

  • The libraries have added a target for net6.0, and various optimizations to take advantage of 6.0.
  • Query parameter based routing, and additional modes for header based routing. #1277
  • Response transforms will be run even if the destination failed to respond. #1257
  • HttpForwarder uses the same default transforms as the rest of YARP, including X-Forwarded-* headers and removing the Host header. #1246
  • New WebSockets telemetry middleware. #1237
  • Support for header allow lists. #1137

For a full list of changes see here.

reverse-proxy - 1.0.0-preview.12.21451.3 Security Patch

Published by Tratcher about 3 years ago

Security Patch

A security issue was identified in YARP involving HTTP request smuggling for HTTP/1.1. The fix has been backported and updated preview12 packages are now available on NuGet.org.

This release supports .NET Core 3.1 and .NET 5.0. See Getting Started.

reverse-proxy - 1.0.0-preview12

Published by alnikola over 3 years ago

This release supports .NET Core 3.1 and .NET 5.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

This release contains a number of API breaking changes that aim to make YARP easier and more consistent to use.

  • Core types are renamed to better indicate their responsibilities
    • ClusterConfig => ClusterModel
    • Cluster => ClusterConfig
    • ClusterInfo => ClusterState
    • RouteConfig => RouteModel
    • ProxyRoute => RouteConfig
    • RouteInfo => RouteState
    • DestinationConfig => DestinationModel
    • Destination => DestinationConfig
    • DestinationInfo => DestinationState
  • Cluster sub option types are also renamed
    • HealthCheckOptions => HealthCheckConfig
    • ActiveHealthCheckOptions => ActiveHealthCheckConfig
    • PassiveHealthCheckOptions => PassiveHealthCheckConfig
    • ProxyHttpClientOptions => ProxyHttpClientConfig
    • WebProxyOptions => WebProxyConfig
    • RequestProxyOptions => ForwarderRequestConfig
    • SessionAffinityOptions => SessionAffinityConfig
  • Client certificate configuration is removed from HttpClientConfig #994
    • Added configure client certificate sample Details
  • QueryParameterTransform can set an empty value "" to a parameter. #978
  • RequestHeaderEncoding is set as a string in configuration #995
  • Session affinity API changed
    • Renamed ISessionAffinityProvider => ISessionAffinityPolicy
    • Renamed AffinitizeRequest => AffinitizeResponse
    • Renamed SessionAffinityConfig.Mode => SessionAffinityConfig.Provider
    • Renamed AffinityFailurePolicies => FailurePolicies
    • New mandatory setting SessionAffinityConfig.AffinityKeyName are used by both of cookie and custom header affinity provider to set the cookie name or the custom header name respectively
    • New strongly-typed section SessionAffinityCookieConfig is added to configure the cookie affinity provider
    • SessionAffinityConfig.Settings collection is removed
  • Projects structure is refactored by flattening hierarchy and regrouping files, changing several namespaces #1035
  • Renamed IHttpProxy => IHttpForwarder. In this context, "Forwarder" term is now used instead of "Proxy", thus in all related type the "Proxy" in the name are replaced with "Forwarder" (e.g. IProxyHttpClientFactory => IForwarderHttpClientFactory, IProxyErrorFeature => IForwarderErrorFeature, AddHttpProxy => AddHttpForwarder)
  • Changed the return type of IHttpForwarder.SendAsync it now returns ValueTask<ForwarderError>
  • Renamed load balancing policy LoadBalancingPolicies.First => LoadBalancingPolicies.FirstAlphabetical
  • Renamed IActiveHealthCheckMonitor.InitialDestinationsProbed => InitialProbeCompleted
  • X-Forwarded-* and Forwarded header transforms changed. Details
    • New transform actions supported: Set, Remove, Off
    • Prefix config setting renamed to HeaderPrefix
    • Separate action configuration for each of X-Forwarded-* headers. Example:
    {
    "X-Forwarded": "Set",
    "For": "Remove",
    "Proto": "Append",
    "Prefix": "Off",
    "HeaderPrefix": "X-Forwarded-"
}
    • Default action for X-Forwarded-* and Forwarded transforms is Set
  • RequestHeader, ResponseHeader, and ResponseTrailer transforms no longer use "Set": "" (empty) to remove a header. See the new *Remove transforms below.

Other major changes and features

  • Cluster's available destination list is now updated by IClusterDestinationsUpdater service based on destinations health status. Two update policies HealthyAndUnknown and HealthyOrPanic are added which can be configure on a cluster like this:
"cluster1": {
  "AvailableDestinationsPolicy": "HealthyOrPanic",
  "HealthCheck": {
    "Passive": {
      "Enabled": "true"
    }
    //...
}
  • New transforms added: RequestHeaderRemove, ResponseHeaderRemove, ResponseTrailerRemove. Details
  • Connection specific headers are removed from request and responses #1008, #1050
  • User-Agent is for active health check requests #1013
  • README.md added for the samples folder
  • Documentation for proxying gRPC traffic is added
reverse-proxy - 1.0.0-preview11

Published by MihaZupan over 3 years ago

This release supports .NET Core 3.1 and .NET 5.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Major changes and features:

  • [Breaking change] This release contains a number of API breaking changes that aim to make YARP easier and more consistent to use:
    • ProxyMatch => RouteMatch
    • AddProxyConfigFilter => AddConfigFilter
    • UseProxyLoadBalancing => UseLoadBalancing
    • UseAffinitizedDestinationLookup => UseSessionAffinity
    • Removed RouteManager, ClusterManager, DestinationManager
    • Changed the routes config model from an array to a Dictionary - #900
      Sample change might look like:
    "Routes": [
  {
    "RouteId": "route1",
    "ClusterId": "cluster1"
  }
]

    "Routes": {
  "route1": {
    "ClusterId": "cluster1"
  }
}
  • [Breaking change] X-Fowarded-PathBase header has been replaced with X-Forwarded-Prefix
  • Added the ability to interrupt and replace proxy responses (like adding retries) - #866
  • Exposed ProxyHttpClientFactory, simplifying the customization of HttpClient instances - #869
  • Added WebProxy support for outgoing requests - #879
  • [Breaking change] For the Telemetry.Consumption library, removed Add*TelemetryListener methods in favour of a single AddTelemetryListeners, forcing consumer lifetime to singleton - #928
  • Many small fixes

For a complete list of changes see the PR history.

reverse-proxy - 1.0.0-preview10

Published by MihaZupan over 3 years ago

This release supports .NET Core 3.1 and .NET 5.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Major changes and features:

  • [Breaking change] Rebranded from Microsoft.ReverseProxy to Yarp.ReverseProxy. This includes the package name and namespaces.
  • Added support for specifying non-ASCII request header encodings (#760). See docs.
  • Exposed extension methods on HttpContext for accessing IReverseProxyFeature/ClusterInfo/RouteConfig (#814).
  • Changed EnableMultipleHttp2Connections default to true.
  • Exposed TlsFrameHelper (#820).
  • Added support for ProxyHttpClientOptions in ServiceFabric.
  • Many small fixes and performance improvements.

For a complete list of changes see the PR history.

reverse-proxy - 1.0.0-preview9

Published by Tratcher over 3 years ago

This release supports .NET Core 3.1 and .NET 5.0. See Getting Started.

The Microsoft.ReverseProxy packages are available on NuGet.org.

Major changes and features:

  • We started publishing a preview of the Microsoft.ReverseProxy.Telemetry.Consumption package.
  • [Breaking change] Converted to a read-only object model (#662).
  • [Breaking change] Transform extensibility (#703) See docs.
  • Many small fixes and performance improvements.

For a complete list of changes see the PR history.

Package Rankings
Top 4.06% on Proxy.golang.org
Related Projects
learn-microsoft-graph-connectors-dotnet

Project for the Build Microsoft Graph connectors with .NET learn module

19 Aug 2024 0
yardl

Tooling for streaming instrument data

04 Nov 2022 31
typescript-error-deltas

Test popular repos on new versions of TypeScript: display new compiler errors

25 Jan 2022 22
security-devops-actions-toolkit

Microsoft Security DevOps for GitHub Actions toolkit.

20 Feb 2021 8
devhomegithubextension

Dev Home GitHub Extension

04 Apr 2023 281
Power-CAT-Copilot-Studio-Kit

25 Apr 2024 49
learn-microsoft-graph-connectors-typescript

Project for the Build Microsoft Graph connectors with TypeScript learn module

19 Aug 2024 0
cppgraphqlgen

C++ GraphQL schema service generator

27 Jul 2018 323
botbuilder-python

The Microsoft Bot Framework provides what you need to build and connect intelligent bots that int...

10 Jan 2018 700
PhoneticMatching

A phonetic matching library. Includes text utilities to do string comparisons on phonemes (the so...

21 Jun 2018 154
chiron

In Greek mythology, Chiron is a wise centaur known for his knowledge of medicine and healing.

09 Aug 2024 4
federal-ai-services

Secure AI Solutions

15 Aug 2024 3
BotBuilder-Samples

Welcome to the Bot Framework samples repository. Here you will find task-focused samples in C#, J...

20 Sep 2016 4,357
VSTSAgent.PowerShell

Tools for managing and automating your Azure DevOps Agents.

03 May 2018 29
opensource-management-portal

Microsoft's monolithic, opinionated Open Source Management Portal enabling enterprise scale self-...

13 Nov 2015 486