Why do Url.Action and Request.Url.Host return "localhost"?

Question

I have a form on a page that posts to an external application and I need to send a URL in that post. However, for SOME users the URL is https://localhost/Home/MyAction rather than https://mysubdomain.domain.com/Home/Action. I haven't been able to reproduce this, but two coworkers get this consistently on the same network as me.

<form action="https://externalapp.com/action.cgi" method="POST">
    ...
    <input type="hidden" name="URL" value="@Url.Action("MyAction", "Home", null, "https")"/>
    <input type="submit" value="Submit" />
</form>

I've tried:

• Url.Action("MyAction", "Home", null, "https")
• Url.Action("MyAction", "Home", null, "https", Request.Url.Host) // This is what MVC does I believe if you don't specify a host
• Url.Action("MyAction", "Home", null, "https", Request.Url.Authority)
• Url.Action("MyAction", "Home", null, "https", Request.Headers["host"]) // If you use a non-standard port, that port would appear twice in the URL (e.g. https://mysubdomain.domain.com:4430/Home/Action.

Why would some users see localhost at all with this? None of the users are accessing this application from the server on which it's hosted.

Update: Internally the application is accessed with a port number like https://mysubdomain.domain.com:445/. Externally it's just the normal 443: https://mysubdomain.domain.com/. For internal users, Url.Action is working perfectly fine. For external users, even if I specify mysubdomain.domain.com to Url.Action, it's still returning localhost for those accessing using port 443. I looked at the MVC code for this and I couldn't figure out why it would overwrite my hostname specification.

I checked the HTTPS binding in IIS and it's using the correct SSL certificate. I wonder if somehow the port forwarding from external 443 to internal 445 is breaking it?

Answer 1

You mention port forwarding in your post. Where is this port forwarding done? If it's done on the IIS box, is it possible someone configured the forwarding like so:

https://mysubdomain.domain.com:445 -> http://localhost:443

That would cause url resolution to use local host, but internally, the port forwarding doesn't occur, so the correct domain is resolved.