Aspnetcore.docs: Restrict health check to GET HTTP method

[APIWT]

Hello!

Is it possible to restrict all health checks to GET requests? We are seeing a warning in our security scans on these endpoints classified as HTTP method fuzzing.

If not, is it possible to work around this with the response writer?

Thanks!

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: c0cbb094-29e9-740a-9fd6-db372641d753
• Version Independent ID: 52d8efc9-a336-71d9-6d90-98173cbf6bf4
• Content: Health checks in ASP.NET Core
• Content Source: aspnetcore/host-and-deploy/health-checks.md
• Product: aspnet-core
• Technology: aspnetcore-hostdeploy
• GitHub Login: @guardrex
• Microsoft Alias: riande

[guardrex]

@APIWT Is your scanning external to the firewall or internal? If external, a non-public port should be ok ...

app.UseHealthChecks("/health", port: 8000);

https://docs.microsoft.com/aspnet/core/host-and-deploy/health-checks#filter-by-port

If not AFAIK, there's nothing built-in for non-GET method restrictions. You could make a request to engineering tho on the engineering repo ... they're happy to have dev feedback on scenarios like this. https://github.com/aspnet/AspNetCore/issues

[APIWT]

It is external, but changing the port does not help. For multiple reasons, we need the health checks to be on the same port as the rest of the application.

We are really only interested in solutions that restrict the HTTP request methods allowed on the endpoint.

[guardrex]

I see. Open an issue with engineering. Let's close here, but please do come back and ping me here if you get good news from them. We can add something to the topic if that's the case.

[APIWT]

@guardrex Here was the suggestion (which works for us) from engineering: https://github.com/aspnet/AspNetCore/issues/10488

Would you guys mind adding this to your docs?

[guardrex]

Perfect! Great idea. I'll get this scheduled.

[APIWT]

Awesome! Thank you for your help.