A security issue was identified in how this release of YARP processes input. Please update to 1.1.0-rc.1.22211.2.

This release supports .NET Core 3.1, .NET 5.0, and .NET 6.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

• We made a change to how distributed tracing headers are proxied, allowing for easier configuration of pass-through scenarios. #1533 When using direct forwarding, you must now also configure the ActivityHeadersPropagator on the SocketsHttpHandler to match the default behavior of YARP 1.0:

  new SocketsHttpHandler()
  {
      // ...
  +   ActivityHeadersPropagator = new ReverseProxyPropagator(DistributedContextPropagator.Current)
  };
  

Other changes

• Added support for multiple configuration sources. #1534
• YARP will use zero-byte reads when proxying the request & response bodies, reducing the memory consumption of long-running requests by up to 6x when the runtime supports it. #1415
• We are now using non-validated headers. This avoids subtle transformations/removals of header values, while avoiding many allocations and providing a significant performance improvement. #1507
• Added an IProxyStateLookup interface, giving you real-time access to clusters and routes. Also added a ReassignProxyRequest extension method allowing you to change the cluster after routing has already run. These are the key building blocks for creating custom A/B testing and rolling upgrade systems. #1538
• Added support for Http.Sys request delegation. #1556
• You can now modify the request body within a request transform, as YARP won't capture the body before transforms run. #1569
• YARP now throws if the request body length does not match the Content-Length header, providing a useful diagnostic when bodies are modified in-process without updating the headers. #1462
• Fixed a bug where the cluster model wasn't updated on destination-only configuration changes. #1568
• Added a static HttpTransformer.Empty field next to the existing HttpTransformer.Default for easy access to a transformer without the X-Forwarded-* and OriginalHost transforms. #1444
• Made QueryTransformContext case-insensitive to match ASP.NET behavior. #1553

For a full list of changes see here.