This release supports .NET 6.0 and .NET 7.0. See Getting Started.

The Yarp.ReverseProxy packages are available on NuGet.org.

Breaking changes

• We dropped support for .NET Core 3.1 and .NET 5.0 as they are no longer supported.
  • YARP 2.0 targets .NET 6 and .NET 7.
• The default session affinity policy has been changed from Cookie to HashCookie (#1989).
  • This policy provides fewer security guarantees about the protection level of the key data - the destination ids. On the other hand, it allows for multiple YARP instances to share session affinity cookies without the need to configure ASP.NET Core Data Protection.
  • For more details, see the Session Affinity documentation.
• YARP now sets the SocketsHttpHandler.ConnectTimeout by default (#1991). You may observe different exceptions being reported by the proxy in failure scenarios when destination servers aren't responding. See #1678 for more context on this change.
• The name of the enum value TlsHandshakeType.KeyEpdate has been corrected to KeyUpdate (#1614).

Major changes

• Added support for WebSockets over HTTP/2 (#1978).
  • Protocol upgrades and downgrades are automatic. You can mix different protocol versions on both incoming and outgoing sides.
  • This feature is available on .NET 7.0 and newer only. To accept HTTP/2 WebSockets, you must use Kestrel.
  • See the YARP WebSockets documentation for more details.
• Request transforms can now short-circuit requests and avoid proxying (#1923).
  • If you set the status code on the response to something other than 200 OK, or if you start writing to the response body, forwarding will be skipped.
  • See the Request Transforms documentation for more details.

Other changes

• You can specify the RateLimiterPolicy on a route from the configuration (#1967). See the Rate Limiting documentation for more details.
• You can specify the MaxRequestBodySize on a route from the configuration (#1947).
• We exposed the InMemoryConfigProvider as a built-in API (#1732). You no longer have to copy the implementation from the samples :)
• Added an IConfigChangeListener interface you can implement to receive notifications when and if configuration has been applied (#1734).
• Added an IHttpForwarder.SendAsync overload that accepts a cancellation token (#1985).
• Added async APIs to ISessionAffinityPolicy (#1990).
• Added an overload of ReassignProxyRequest that also accepts a route (#1760).
• Added a HeaderMatchMode.NotExists mode to header routing (#1806).
• Added an AddMetricsConsumer helper method to make it easier to register a consumer with multiple IMetricsConsumers (#1899).
• We report a warning early if you define multiple routes with the same ID (#1831).
• We throw if you use a custom IForwarderHttpClientFactory and also call ConfigureHttpClient as the two are mutually exclusive (#1805).
• We no longer restore the Upgrade response header unless there is a matching entry in the Connection header (#1731).
• We remove the Content-Length: 0 header on responses that don't allow bodies (#1813).
• We no longer proxy the Strict-Transport-Security header (#1984).

For a full list of changes see here.