🚀 Production-Ready YARP Setup

A production-ready YARP setup is usually much more than MapReverseProxy() and a couple of routes. In enterprise .NET environments, YARP often acts as an API Gateway responsible for:

• ✅ Routing
• ✅ Authentication
• ✅ Authorization
• ✅ Rate limiting
• ✅ Health checks
• ✅ Service discovery
• ✅ Correlation IDs
• ✅ Distributed tracing
• ✅ Logging
• ✅ Resilience
• ✅ Load balancing

🏗️ Common Production Architecture

📁 Solution Structure

Gateway
│
├── Program.cs
├── appsettings.json
├── Middleware
│    └── CorrelationIdMiddleware.cs
│
├── Extensions
│    └── ServiceCollectionExtensions.cs
│
└── Controllers

📦 NuGet Packages

 dotnet add package Yarp.ReverseProxy
dotnet add package Microsoft.AspNetCore.RateLimiting
dotnet add package AspNetCore.HealthChecks.UI.Client
dotnet add package OpenTelemetry.Extensions.Hosting
dotnet add package OpenTelemetry.Exporter.Console 

⚙️ Production appsettings.json

This example has:

• ✅ User service
• ✅ Product service
• ✅ Multiple replicas
• ✅ Load balancing

{
  "ReverseProxy": {
    "Routes": {
  "users-route": {
    "ClusterId": "users-cluster",
    "Match": {
  "Path": "/api/users/{**catch-all}"
    }
  },
  "products-route": {
    "ClusterId": "products-cluster",
    "Match": {
  "Path": "/api/products/{**catch-all}"
    }
  }
    },
    "Clusters": {
  "users-cluster": {
    "LoadBalancingPolicy": "RoundRobin",
    "Destinations": {
  "api1": {
    "Address": "https://users-api-1/"
  },
  "api2": {
    "Address": "https://users-api-2/"
  }
    }
  },
  "products-cluster": {
    "LoadBalancingPolicy": "RoundRobin",
    "Destinations": {
  "api1": {
    "Address": "https://products-api-1/"
  },
  "api2": {
    "Address": "https://products-api-2/"
  }
    }
  }
    }
  }
}    

🛠️ Program.cs

A production startup configuration.

using System.Threading.RateLimiting;
using Microsoft.AspNetCore.HttpOverrides;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddReverseProxy()
    .LoadFromConfig(
    builder.Configuration.GetSection("ReverseProxy"));

builder.Services.AddHealthChecks();

builder.Services.AddHttpContextAccessor();

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter(
    "api",
    limiterOptions =>
    {
    limiterOptions.PermitLimit = 100;
    limiterOptions.Window = TimeSpan.FromMinutes(1);
    });
});

builder.Services.Configure(options =>
{
    options.ForwardedHeaders =
    ForwardedHeaders.XForwardedFor |
    ForwardedHeaders.XForwardedProto;
});

var app = builder.Build();

app.UseForwardedHeaders();

app.UseRateLimiter();

app.UseHttpsRedirection();

app.MapHealthChecks("/health");

app.MapReverseProxy();

app.Run(); 

🔐 Authentication at Gateway

One of the most common production patterns.

Instead of every microservice validating JWT tokens:

Client
   |
JWT
   |
YARP Gateway
   |
Validated
   |
Microservices

Configure JWT:

builder.Services
    .AddAuthentication("Bearer")
    .AddJwtBearer("Bearer", options =>
    {
    options.Authority = "https://identity.company.com";
    options.Audience = "gateway-api";
    });

builder.Services.AddAuthorization();
 

Enable:

 app.UseAuthentication(); app.UseAuthorization(); 

Routes:

{
  "Routes": {
    "users-route": {
  "ClusterId": "users-cluster",
  "AuthorizationPolicy": "default",
  "Match": {
    "Path": "/api/users/{**catch-all}"
  }
    }
  }
}

🔗 Correlation ID

Critical for troubleshooting across services.

Request:

RequestId=ABC123

Must follow every API call.

Middleware:

public class CorrelationIdMiddleware
{
    private readonly RequestDelegate _next;

    public CorrelationIdMiddleware(RequestDelegate next)
    {
    _next = next;
    }

    public async Task Invoke(HttpContext context)
    {
    var correlationId =
    context.Request.Headers["X-Correlation-ID"]
    .FirstOrDefault()
    ?? Guid.NewGuid().ToString();

    context.Response.Headers["X-Correlation-ID"] =
    correlationId;

    await _next(context);
    }
} 

Register:

 app.UseMiddleware(); 

📊 Logging

Never log only:

 logger.LogInformation("Request received"); 

Instead:

 logger.LogInformation( "Path:{Path} Correlation:{CorrelationId}", context.Request.Path, correlationId); 

Good logs answer:

• 👤 Who called?
• 🕒 When?
• 🌐 What endpoint?
• 🔧 Which service?
• 🆔 Correlation Id?
• ⏱️ Execution time?

📡 OpenTelemetry

Modern production systems use distributed tracing.

 builder.Services
    .AddOpenTelemetry()
    .WithTracing(tracing =>
    {
        tracing.AddAspNetCoreInstrumentation();

        tracing.AddHttpClientInstrumentation();

        tracing.AddConsoleExporter();
    }); 

Flow:

Gateway
   |
   | TraceId
   |
User Service
   |
Order Service
   |
Payment Service

✅ Single trace across all services.

🛡️ Retry & Resilience

Backend services occasionally fail.

Use HttpClient resilience.

 builder.Services .AddHttpClient("proxy") .AddStandardResilienceHandler(); 

Handles:

• ✅ Retries
• ✅ Timeout
• ✅ Circuit breaker

❤️ Health Checks

Every service should expose:

/health

Example:

app.MapHealthChecks("/health"); 

Response:

{    "status": "Healthy" } 

✅ Load balancers can remove unhealthy instances automatically.

🚦 Rate Limiting

Prevent abuse.

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter(
    "gateway",
    config =>
    {
    config.PermitLimit = 100;
    config.Window = TimeSpan.FromMinutes(1);
    });
});

Example:

100 requests/minute

After that:

429 Too Many Requests

🔒 Header Hardening

Add security headers.

app.Use(async (context, next) =>
{
    context.Response.Headers.Append(
    "X-Content-Type-Options",
    "nosniff");

    context.Response.Headers.Append(
    "X-Frame-Options",
    "DENY");

    context.Response.Headers.Append(
    "Referrer-Policy",
    "strict-origin");

    await next();
});

☸️ Kubernetes Production Setup

Instead of hardcoding servers:

"Address": "https://10.1.5.23:5000" 

Use service DNS:

 "Address": "http://user-service/" 

Architecture:

YARP
  |
  +--> user-service
  +--> order-service
  +--> payment-service

✅ Kubernetes resolves service addresses automatically.

❌ What Most Developers Get Wrong

1. Storing Sessions In Memory

Bad:

Gateway
   |
  App1
  App2

with:

AddSession() 

using in-memory store. User may hit different servers.

Use:

Redis
SQL
Distributed Cache

2. No Forwarded Headers

Wrong client IP.

app.UseForwardedHeaders(); 

is mandatory behind proxies.

3. Gateway Contains Business Logic

Bad:

YARP
  |
  + Calculate Taxes
  + Create Orders

Gateway should focus on:

• ✅ Routing
• ✅ Security
• ✅ Validation
• ✅ Observability

Business logic belongs to services.

4. No Timeouts

A slow downstream service can consume all gateway threads.

Configure:

{   "HttpRequest": { "ActivityTimeout": "00:00:30"   } } 

✅ Enterprise-Grade Setup Checklist

• ✅ HTTPS everywhere
• ✅ JWT authentication
• ✅ Authorization policies
• ✅ Health checks
• ✅ Rate limiting
• ✅ Correlation IDs
• ✅ Structured logging (Serilog)
• ✅ OpenTelemetry tracing
• ✅ Retry policies
• ✅ Distributed cache
• ✅ Load balancing
• ✅ Security headers
• ✅ Kubernetes service discovery
• ✅ Centralized configuration
• ✅ Monitoring (Grafana/AppInsights)
• ✅ WAF in front of gateway

This gives you centralized security, routing, observability, and scalability while keeping individual microservices simple and focused on business logic.