title: Dotnet core identityserver4 reverse proxy
body: <p>Hi everybody I have a problem with my reverse proxy configuration for my dotnet core application. My problem is that when I am using identityserver discovery endpoint the port number is missing from the end of my url.</p>
  <p>I have a request for the discorvery document to
  https://:8421/.well-known/openid-configuration
  and the response is the following and the problem here is that the clients of the authentication service are using the document as a base for verification, using jwks_uri property from the response, the url listed in that property has the missing port number, so the clients cant call the openId configuration.</p>
  <pre><code> {
      &quot;issuer&quot;: &quot;https://&lt;servername&gt;&quot;,
      &quot;jwks_uri&quot;: &quot;https://&lt;servername&gt;/.well-known/openid-configuration/jwks&quot;,
      &quot;authorization_endpoint&quot;: &quot;https://&lt;servername&gt;/connect/authorize&quot;,
      &quot;token_endpoint&quot;: &quot;https://&lt;servername&gt;/connect/token&quot;,
      &quot;userinfo_endpoint&quot;: &quot;https://&lt;servername&gt;/connect/userinfo&quot;,
      &quot;end_session_endpoint&quot;: &quot;https://&lt;servername&gt;/connect/endsession&quot;,
      &quot;check_session_iframe&quot;: &quot;https://&lt;servername&gt;/connect/checksession&quot;,
      &quot;revocation_endpoint&quot;: &quot;https://&lt;servername&gt;/connect/revocation&quot;,
      &quot;introspection_endpoint&quot;: &quot;https://&lt;servername&gt;/connect/introspect&quot;,
      &quot;device_authorization_endpoint&quot;: &quot;https://&lt;servername&gt;/connect/deviceauthorization&quot;
  }
  </code></pre>
  <p>expected result for endpoint config:</p>
  <pre><code>  {
      &quot;jwks_uri&quot;: &quot;https://&lt;servername&gt;:&lt;port&gt;/.well-known/openid-configuration/jwks&quot;,
    }
  </code></pre>
  <p>In my dotnet app I setup the reverse proxy settings</p>
  <pre><code>  services.Configure&lt;ForwardedHeadersOptions&gt;(options =&gt;
          {
              options.ForwardedHeaders =
                           ForwardedHeaders.XForwardedFor |
                           ForwardedHeaders.XForwardedHost |
                           ForwardedHeaders.XForwardedProto;
  
              options.ForwardLimit = 2;  //Limit number of proxy hops trusted
              options.KnownNetworks.Clear();
              options.KnownProxies.Clear();
          });
    app.UseForwardedHeaders();
  </code></pre>
  <p>nginx config is the following</p>
  <pre><code>server {
      listen &lt;ip&gt;:8421 ssl;
      server_name _; 
  
      ssl_certificate    &lt;certPath&gt; ;
      ssl_certificate_key &lt;certPath&gt;;
   
  
      location / {
          proxy_pass http://127.0.0.1:8421; 
  
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $remote_addr;
          proxy_set_header X-Forwarded-Host $remote_addr;
          proxy_set_header X-Forwarded-Proto https;
          proxy_set_header X-Forwarded-Port 8421;
      }
  }
  </code></pre>
  <p>Before updateing to Identityserver 4 4.0 it had the Public origin property but it became deprecated with 4.0. Now instead it is using the dotnet baseurl.</p>
  <p>In the http pipeline I also logged all the headers from the request and got this result:</p>
  <pre><code>2020-07-03 11:40:15.109 +00:00;[INF];Cache-Control--no-cache Connection--upgrade Accept--*/* Accept-Encoding--gzip, deflate, br Host--&lt;hostName&gt; User-Agent--PostmanRuntime/7.26.1 X-Real-IP--&lt;ip&gt; X-Original-Proto--http X-Forwarded-Host--&lt;domainName with port&gt; X-Forwarded-Port--8421 Postman-Token--44dc6573-71eb-4b36-8b2a-9768d71e5b64 X-Original-For--&lt;ip address&gt; ;;
  </code></pre>