Should AllowedHosts be in the template appsettings.json?

[eerhardt]

By default the appsettings.json file in the templates have "AllowedHosts": "*".

From everything I can tell from the code, this appears to be used for "host filtering":

aspnetcore/src/DefaultBuilder/src/WebHost.cs

Lines 253 to 268 in d07f377

	// Fallback
	services.PostConfigure<HostFilteringOptions>(options =>
	{
	if (options.AllowedHosts == null || options.AllowedHosts.Count == 0)
	{
	// "AllowedHosts": "localhost;127.0.0.1;[::1]"
	var hosts = hostingContext.Configuration["AllowedHosts"]?.Split(new[] { ';' }, StringSplitOptions.RemoveEmptyEntries);
	// Fall back to "*" to disable.
	options.AllowedHosts = (hosts?.Length > 0 ? hosts : new[] { "*" });
	}
	});
	// Change notification
	services.AddSingleton<IOptionsChangeTokenSource<HostFilteringOptions>>(
	new ConfigurationChangeTokenSource<HostFilteringOptions>(hostingContext.Configuration));
	services.AddTransient<IStartupFilter, HostFilteringStartupFilter>();

aspnetcore/src/Middleware/HostFiltering/src/HostFilteringMiddleware.cs

Lines 63 to 70 in d07f377

	public Task Invoke(HttpContext context)
	{
	var allowedHosts = EnsureConfigured();
	if (!CheckHost(context, allowedHosts))
	{
	return HostValidationFailed(context);
	}

However, as you can see above the default value, if not configured, is *. So there might not be value in putting this configuration value in appsettings for all the templates.

We should consider removing this config value from the templates if it doesn't add value.

See the discussion here.

[Tratcher]

cc @blowdart
It was put there for discoverability since it's a security related setting we encourage users to set.

[blowdart]

I said that in a PR :)

It should stay

[amcasey]

Any final thoughts, @eerhardt?