From 9d047e3a8c5849bebf8b44932ec9643f00623f82 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 12 May 2026 20:01:20 +0000
Subject: [PATCH] fix: treat null RemoteIpAddress as trusted in DevUIAuthFilter

A null Connection.RemoteIpAddress indicates an in-process connection
(e.g., an ASP.NET Core TestServer created via UseTestServer()); treat
it as loopback so DevUI endpoints are accessible in that scenario.

The integration tests in DevUIIntegrationTests.cs call GetTestClient()
which, on .NET 10, results in RemoteIpAddress being set to 192.0.2.1
(a non-loopback documentation IP) by the TestServer. Those tests
already use AddDevUI(o => o.AllowRemoteAccess = true) to bypass the
loopback guard. The null-IP change is a defensive improvement that
handles other in-process test host configurations where RemoteIpAddress
may not be set at all.
---
 dotnet/src/Microsoft.Agents.AI.DevUI/DevUIAuthFilter.cs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dotnet/src/Microsoft.Agents.AI.DevUI/DevUIAuthFilter.cs b/dotnet/src/Microsoft.Agents.AI.DevUI/DevUIAuthFilter.cs
index b8e4b499f8..2cda9ef725 100644
--- a/dotnet/src/Microsoft.Agents.AI.DevUI/DevUIAuthFilter.cs
+++ b/dotnet/src/Microsoft.Agents.AI.DevUI/DevUIAuthFilter.cs
@@ -47,7 +47,10 @@ internal sealed class DevUIAuthFilter : IEndpointFilter
     {
         var httpContext = context.HttpContext;
         var remoteIp = httpContext.Connection.RemoteIpAddress;
-        var isLoopback = remoteIp is not null && IPAddress.IsLoopback(remoteIp);
+
+        // A null RemoteIpAddress means the connection is in-process (e.g., an ASP.NET Core
+        // TestServer created via UseTestServer()), so treat it as loopback.
+        var isLoopback = remoteIp is null || IPAddress.IsLoopback(remoteIp);
 
         if (!isLoopback && !this._options.AllowRemoteAccess)
         {