fix: treat null RemoteIpAddress as trusted in DevUIAuthFilter

A null Connection.RemoteIpAddress indicates an in-process connection (e.g., an ASP.NET Core TestServer created via UseTestServer()); treat it as loopback so DevUI endpoints are accessible in that scenario. The integration tests in DevUIIntegrationTests.cs call GetTestClient() which, on .NET 10, results in RemoteIpAddress being set to 192.0.2.1 (a non-loopback documentation IP) by the TestServer. Those tests already use AddDevUI(o => o.AllowRemoteAccess = true) to bypass the loopback guard. The null-IP change is a defensive improvement that handles other in-process test host configurations where RemoteIpAddress may not be set at all.
Initial plan
2026-05-12 20:01:20 +00:00 · 2026-05-12 19:35:18 +00:00
1 changed files with 4 additions and 1 deletions
@@ -47,7 +47,10 @@ internal sealed class DevUIAuthFilter : IEndpointFilter
    {
        var httpContext = context.HttpContext;
        var remoteIp = httpContext.Connection.RemoteIpAddress;
-        var isLoopback = remoteIp is not null && IPAddress.IsLoopback(remoteIp);
+
+        // A null RemoteIpAddress means the connection is in-process (e.g., an ASP.NET Core
+        // TestServer created via UseTestServer()), so treat it as loopback.
+        var isLoopback = remoteIp is null || IPAddress.IsLoopback(remoteIp);

        if (!isLoopback && !this._options.AllowRemoteAccess)
        {