HTTPS, TLS and certificates
TLS termination and reverse proxies
Define trust on every connection leg.
Understand the concept
When a CDN or proxy terminates TLS, it can inspect the decrypted request. The origin connection is a separate leg with its own encryption and authentication settings. Public HTTPS does not automatically encrypt internal traffic. Evaluate direct-origin access too.
Forwarded scheme and host fields can describe the external request, but trusting arbitrary client-supplied values invites spoofing and incorrect redirects. Accept them only through a configured trusted-proxy chain with defined cleanup and hop rules.
ASP.NET Core handling depends on configuration and version. Correctly connect proxy trust to secure cookies, absolute URLs and redirects, then test the actual deployment path.
Diagnose deployment redirect loops and incorrect URLs.
Trusting forwarded scheme headers from anyone.
One topic. Three levels of depth.
Browser ─HTTPS─ proxy ─HTTPS─ APIThere are two separate TLS connections.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
Does external HTTPS protect a plaintext origin leg?
Show the solution and explanation
Client leg security ≠ origin leg securityNo; protect the second leg separately.