3 ms·
> No patches are available for ASP.NET Core 1.0.x or ASP.NET Core 1.1.x. Microsoft requires that you place your 1.x ASP.NET Core application behind a proxy (...
by magnat 9y ago
> No patches are available for ASP.NET Core 1.0.x or ASP.NET Core 1.1.x. Microsoft requires that you place your 1.x ASP.NET Core application behind a proxy (...) If you're not running ASP.NET Core 1.x behind a proxy, you must either place a proxy in front of your application or upgrade to ASP.NET Core 2.0.
This is quite alarming. Does this mean I'll have to continuously upgrade my applications (and all third-party libraries) to the newest .NET Core version to receive security updates? Upgrading from 1.1 to 2.0, when you reference dozens of external packages isn't too pleasant, even for small applications.
- barake 9y agoSince the 1.0 release the docs, tutorials, quick starts, etc have said not to expose ASP.NET Core Kestrel based apps directly to internet traffic. Here is the current version of the docs that mention this: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?tabs=aspnetcore1x#when-to-use-kestrel-with-a-reverse-proxy https://docs.microsoft.com/en-us/aspnet/core/fundamentals/se... The warning was repeated all over the place - you can search the web dig through the git history of the docs and see the warning to use a reverse proxy all over. They probably should have made Kestrel complain loudly if it detected it was exposed and "force" everyone to be successful, but it's only partially their fault if people ignored the documentation.
- oaiey 9y agoFor .NET Core MS recommended for security reasons to put any .NET Core Kestrel standalone apps behind a proxy. This concrete statement is therefore valid (because it should have been done like that). In the past they had vulnerabilities covered in multiple versions at the same time. But keep in mind LTS support versions. Some of the 1.x will soon run out of their lifecycle (when I remember right).