Remove IsLocal

[Tratcher]

We keep getting questions like this: aspnet/Hosting#570 (comment)

Environments are the correct way to handle these scenarios most of the time.

We should remove IsLocal, and possibly replace it with an extension method that just returns RemoteIP.Equals(LocalIP).

@davidfowl @muratg @blowdart

[blowdart]

Yea, kill it IMO

[davidfowl]

We should remove IsLocal, and possibly replace it with an extension method that just returns RemoteIP.Equals(LocalIP).

If we add it back as an extension method won't be in the same place? It seems like an OK thing to remove from ConnectionInfo though.

[Tratcher]

Current recommendation is to remove it without adding an extension.

[muratg]

Yup, no extension method. This was redundant anyway.

[BrennanConroy]

Fixed via 1f21540

[dazinator]

I found this method useful for authorising a user based on if it is a Local request or not. I am aware that this information (ip address) could be spoofed, but I was happy to accept that risk based on mitigating factors, mainly that this is only operational during the initial setup of the site (the first time you access the site after it is installed, it greets you with a setup wizard).

Can you provide a replacement? Perhaps similar to what @Tratcher suggested?

[Tratcher]

IsLocal is more dangerous than it once was because of the prevalence of local reverse proxies (e.g. Nginx, HttpPlatformHandler, AspNetCoreModule, etc.), most requests now appear to be local.

How would your setup process work for a site deployed to a hoster like Azure Web Sites where there is no local access?

Consider using a Staging Environment mode or real credentials based authentication.

[dazinator]

@Tratcher understood. If there is a chance of IsLocal no longer being accurate anymore then I don't wish to use anymore anyway. I'll have to re-think my setup process. :(

[blowdart]

So what I've seen working for some folks is

1. Check for the presence of a marker file or database entry to see if already configured. If present goto 6.
2. Check for the presence of a first run password in a settings file, if not present throw error with instructions on how to set it. Never set a default one in any installer.
3. Login page which asks for the setup password
4. Run setup
5. Drop the "I've been configured" marker
6. Profit.

[dazinator]

@blowdart haha thanks - I like that suggestion, Team City uses that concept too, it generates a system admin login token which it writes to a local log file. Cheers