Support for Hybrid Connections (Azure Relay)

[Danielku15]

Hi everyone.

Whenever I discover a new reverse HTTP proxy system like this project, I always am lacking the feature of allow dynamic exposure of services secured in a local network like in Azure Relay. It would be amazing if this project would support such a hosting scenario out-of-the-box.

The main difference in this concept is that the reverse proxy does not actively contact the exposed applications but it is rather vice versa: The applications in the local network are establishing an outbound connection to the reverse proxy and register themselves with the exposed endpoints. Then the reverse proxy serves the application through these established connections via a custom protocol (like Hybrid Connections).

Main usecases are:

• You are hosting your ASP.net core applications in a local network but want to expose services through a reverse proxy (LAN/DMZ separation for security)
• You are operating your applications in a dynamic environment where instances are created and destroyed so that the reverse proxy cannot be statically configured.

There are some details of course to this automatic configuration:

• An application connecting to the reverse proxy, would additionaly need to provide the routes it wants exposed.
• If multiple applications are registering the same endpoint, we would need to handle it in a load balancing fashion with the Session Affinity features of this library.

I once asked whether Azure Relay will support scenarios where we are hosting the proxy part ourselves, but there are no plans on that.

Technically this could work already through a custom HttpMessageInvoker implementation which does not make a direct HTTP call, but uses a connection from an established connection pool.

We have a custom proprietary library doing this already: On the Proxy/DMZ side, we start an ASP.net core application with a special middleware for the proxy. The LAN applications use a custom IServer implementation to "accept" requests. This server implementation establishes an outbound connection to the known reverse proxy installation via WebSockets and then we tunnel the HTTP requests through this connection.

Considering that Microsoft has Azure Relay with the Hybrid Connection protocol, and there is also now Reverse Proxy library, it would be a nice scenario to let this proxy accept connections according to the Hybrid Connection protocol to expose services. There might be a need to some custom extensions of the Hybrid Connection protocol when it comes to configuring the exposed service.

That's it about my idea, let me know what you think on it. At least for our architectural patterns we have in our services, this idea would be a huge added value if we don't need to maintain a custom solution.

[samsp-msft]

Interesting scenario - its not something we support in V1, but we are looking at this area for the future.