June 2016 hotfix for Microsoft Application Request Routing 3.0

After you install this hotfix, the following fixes are made.

Issue 1

This hotfix adds the trustImmediateProxy attribute to the Application Request Routing Helper module configuration settings. TrustImmediateProxy controls whether the server from which the request was received should be automatically added to the trustedProxies list. If it's not otherwise specified, trustImmediateProxy is set to "false."

After you apply this hotfix, the default for the trustUnlisted attribute is changed from "true" to "false."

Sample configuration:

<proxyHelper>
  <trustedProxies trustUnlisted="false" trustImmediateProxy="true">
  <add ipAddress="1.1.1.1" />
  <add ipAddress="2.2.2.2" />
  </trustedProxies>
</proxyHelper> 

Issue 2

After you apply this hotfix, Application Request Routing health checks use the SecureConnectionIgnoreFlags setting.

Issue 3

After you apply this hotfix, Application Request Routing supports configuration of a per-web farm collection of SSL server certificate public keys, with optional Algorithm OID strings. This validates the server certificates that are received from web farm workers.

Sample configuration:

<webFarms>
  <webFarm name="MyServerFarm">
  <server address="first.backend.com" enabled="true" />
  <server address="second.backend.com" enabled="true" />
  <applicationRequestRouting>
  <publicKeys>
  <publicKey bytes="112233445566778899AABBCCDDEEFF" algorithmOid="1.2.840.113549.1.1.11" />
  <publicKey bytes="AABBCCDDEEFF112233445566778899" />
  </publicKeys>
  </applicationRequestRouting>
  </webFarm>
</webFarms> 

Notes

• The bytes field is the hex representation of the public key blob of the server certificate, without spaces.
• AlgorithmOid is the string representation of the Algorithm OID. In the preceding example, 1.2.840.113549.1.1.11 corresponds to SHA256. The algorithmOid is optional. If it's not specified, any algorithm OID is acceptable.