Repository: dotnet/aspnetcore
File: src/Middleware/HttpOverrides/src/ForwardedHeadersMiddleware.cs (C#)

Code before:
                }

                request.PathBase = PathString.FromUriComponent(currentValues.Prefix);
            }
        }
    }

    private bool CheckKnownAddress(IPAddress address)
    {
        if (address.IsIPv4MappedToIPv6)
        {
            var ipv4Address = address.MapToIPv4();
            if (CheckKnownAddress(ipv4Address))
            {
                return true;
            }
        }
        if (_options.KnownProxies.Contains(address))
        {
            return true;
        }
        foreach (var network in _options.KnownNetworks)
        {
            if (network.Contains(address))
            {
                return true;
            }
        }
        return false;
    }

    private struct SetOfForwarders
    {
        public string IpAndPortText;
        public IPEndPoint? RemoteIpAndPort;
        public string Host;
        public string Scheme;
        public string Prefix;
    }

    // Empty was checked for by the caller
    [MethodImpl(MethodImplOptions.AggressiveInlining)]
    private static bool TryValidateHost(string host)
    {
        if (host[0] == '[')
        {
            return TryValidateIPv6Host(host);
        }

        if (host[0] == ':')
        {

Review comment (suggestion):
Is there an issue with this part of the change when users can only call `Clear()` on a single collection?

Take [this sample](https://github.com/dotnet/aspnetcore/issues/63627#issue-3403700393) in an issue that was filed recently.

The properties `KnownIPNetworks` and `KnownNetworks` [are both initialized](https://github.com/dotnet/aspnetcore/blob/1da465d2a41b80447c74f44bf0a8933d2d8f9cb4/src/Middleware/HttpOverrides/src/ForwardedHeadersOptions.cs#L90) with a default value of `IPAddress.Loopback`.

If [`ForwardedHeadersOptionsSetup`](https://github.com/dotnet/aspnetcore/blob/1da465d2a41b80447c74f44bf0a8933d2d8f9cb4/src/DefaultBuilder/src/ForwardedHeadersOptionsSetup.cs#L30-L33) is not invoked then one of the collections won't be cleared and then taken into account.

Code after:
                else
                {
                    // All values were consumed
                    requestHeaders.Remove(_options.ForwardedPrefixHeaderName);
                }

                request.PathBase = PathString.FromUriComponent(currentValues.Prefix);
            }
        }
    }

    private bool CheckKnownAddress(IPAddress address)
    {
        if (address.IsIPv4MappedToIPv6)
        {
            var ipv4Address = address.MapToIPv4();
            if (CheckKnownAddress(ipv4Address))
            {
                return true;
            }
        }
        if (_options.KnownProxies.Contains(address))
        {
            return true;
        }
        foreach (var network in _options.KnownIPNetworks)
        {
            if (network.Contains(address))
            {
                return true;
            }
        }
#pragma warning disable ASPDEPR005 // KnownNetworks is obsolete
        foreach (var network in _options.KnownNetworks)
        {
            if (network.Contains(address))
            {
                return true;
            }
        }
#pragma warning restore ASPDEPR005 // KnownNetworks is obsolete
        return false;
    }

    private struct SetOfForwarders
    {
        public string IpAndPortText;
        public IPEndPoint? RemoteIpAndPort;
        public string Host;
        public string Scheme;
        public string Prefix;