Production engineering
using System;
using System.Linq;
using System.Collections.Generic;
using System.Globalization;
using System.Text;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;
var canonical=new Uri(new Uri("https://public.example.test/"),"items/7"); Console.WriteLine(canonical.AbsoluteUri); var allowed=new HashSet<string>(new[]{"lab.example"},StringComparer.OrdinalIgnoreCase); Console.WriteLine(allowed.Contains("lab.example")); Console.WriteLine(allowed.Contains("evil.example"));
Reveal answer and reasoning
The output lines, in order, are “https://public.example.test/items/7”; “True”; “False”. The portable .NET9 console program composes items/7 relative to https://public.example.test/ with the actual Uri API. Its first line is the resulting https://public.example.test/items/7 string. A separate case-insensitive allowed-host set returns True for lab.example and False for evil.example. No DNS query, host-filter middleware or HTTP request occurs. The set comparison is also not a complete implementation of framework host parsing, ports or internationalized host names.
It illustrates ownership of the base URI and a known allowlist without turning two lexical decisions into a network security or authorization system.
Kestrel binding to an address and validating the Host field answer different questions. A working loopback connection does not make an arbitrary Host trusted, and a host allowlist is not a permission check for a person or tenant. Reverse-proxy configurations may preserve or replace host metadata, requiring a policy appropriate to that path. This fixture does not enable forwarded-host rewriting or install TLS certificates for the fictional domains.
It also has no authenticated tenant resolver. Keep those absent responsibilities visible instead of presenting a canonical HTTPS string as evidence that a public service or trusted tenancy boundary was deployed.
What a strong answer covers
- Exact output: https://public.example.test/items/7 | True | False
- The portable .NET9 console program composes items/7 relative to https://public.example.test/ with the actual Uri API.
- Kestrel binding to an address and validating the Host field answer different questions.
Common pitfall
Kestrel binding to an address and validating the Host field answer different questions. A working loopback connection does not make an arbitrary Host trusted, and a host allowlist is not a permission check for a person or tenant. Reverse-proxy configurations may preserve or replace host metadata, requiring a policy appropriate to that path. This fixture does not enable forwarded-host rewriting or install TLS certificates for the fictional domains. It also has no authenticated tenant resolver. Keep those absent responsibilities visible instead of presenting a canonical HTTPS string as evidence that a public service or trusted tenancy boundary was deployed.
Follow-up questions
- How could importing another lesson’s wildcard AllowedHosts file invalidate the host-filter test without changing its endpoint code?
- What separate evidence would be needed to establish TLS or tenant permission for the fictional canonical URI?
Self-review
Choose what to revisit. These marks are your own assessment and are separate from lesson completion.