Sidecar: validate Host header outside Development

[Tanuj Sood (soodt)]

Sidecar: validate Host header outside Development

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Description

Adds ASP.NET Core Host filtering for Microsoft.Identity.Web.Sidecar outside the
Development environment

What

• Registers AddHostFiltering only when the environment is not Development.
• Applies Host filtering in the request pipeline (scoped with UseWhen) rather than globally, so the /healthz endpoint stays exempt.
• In Development, neither check is applied, so the inner-loop experience is unchanged.