Microsoft released an advisory in early July 2026 describing improper validation of certain forwarded headers in ASP.NET Core applications hosted behind IIS. The issue allows an attacker who can control specific headers to bypass authentication middleware in default configurations.

Production sites using cookie or JWT authentication without explicit header sanitization are exposed. The advisory affects applications on the current .NET LTS release when the IIS reverse-proxy module forwards untrusted headers directly to the application.

Immediate steps include applying the latest security update, restricting forwarded headers at the IIS level, and enforcing strict validation inside the application. Delaying mitigation leaves authentication decisions open to manipulation.

#Who Is Affected

Any ASP.NET Core 10 application running on Windows Server with IIS and the ASP.NET Core module is potentially impacted if it relies on headers such as X-Forwarded-For or Authorization without additional checks.

  • Applications using default cookie authentication schemes
  • Deployments that do not set ForwardedHeadersOptions explicitly
  • Sites accepting traffic from untrusted proxies or CDNs

#Mitigation Steps

Apply the July 2026 security update for .NET 10 through Windows Update or the Microsoft Update Catalog first. Then harden the IIS configuration and application startup code.

csharp 
services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    options.KnownNetworks.Clear();
    options.KnownProxies.Clear();
});
  • Limit the ForwardedHeaders middleware to trusted networks only
  • Disable automatic header forwarding in the IIS web.config when not required
xml 
<system.webServer>
  <aspNetCore>
    <forwardedHeaders enabled="false" />
  </aspNetCore>
</system.webServer>

#Verification and Monitoring

After changes, test authentication flows with crafted headers using tools such as curl or Burp Suite. Monitor IIS and application logs for unexpected authentication successes from internal IP ranges.

Add request logging of all forwarded headers during the validation phase for at least 30 days. Re-run the tests after each patch cycle.

Review authentication middleware order so header sanitization occurs before any identity resolution. Keep the application on the latest .NET 10 servicing release.