ASP.Net Core: Where to put app.Use() call to force HTTPS

Question

I've tried a lot of different things and I'm just tired of banging my head on my desk.

I'm creating an ASP.NET Core MVC website. The site works fine until I start trying to test functionality in SSL. I've tried the following links:

The third item kept reappearing on a number of other links, so I attempted multiple ways to get that working. I've moved the code setup into several locations of the Startup class' Configure method. If I place the code segment anywhere before the app.UseMvc() call, I get absolutely nothing: the home page (which isn't under SSL) doesn't come up so I can't follow any links. When I place it after the app.UseMvc() call, any method that uses the [RequireHttps] attribute goes to the "doesn't exist" link. That makes some sense, since I want to use MVC. But how can I test HTTPS?

Where does the code for app.Use(async (context,next)... go?

My current Startup.cs:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    loggerFactory.AddConsole(Configuration.GetSection("Logging"));
    loggerFactory.AddDebug();
            var sslPort = Configuration.GetValue<int>("iisSetting:iisExpress:sslPort");

    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
        app.UseBrowserLink();
    }
    else
    {
        app.UseExceptionHandler("/Home/Error");
    }

    app.UseStaticFiles();

    app.UseMvc(routes =>
    {
        routes.MapRoute(
            name: "default",
            template: "{controller=Home}/{action=Index}/{id?}");
    });

    app.Use(async (context, next) =>
    {
        if (context.Request.IsHttps)
            await next();
        else
        {
            var sslPortStr = ((sslPort == 0) || (sslPort == 443)) ? string.Empty : ($":{sslPort}");
            var sslUrl = $"https://{context.Request.Host.Host}{sslPort}{context.Request.Path}";
            context.Response.Redirect(sslUrl);
        }
    }); // */
}

UPDATE: (2017/01/26) I've discovered that if I manually enter the SSL port number into the browser URL, the system enters SSL/HTTPS...but then it stays there, even on the pages that don't need security.

What I'm trying to do is have the correct port numbers show up in the URL without manually needing to type them...and only for testing purposes.

score 0 · Answer 1 · answered Jan 22 '17 at 20:53

0

you do it in configure services:

services.Configure<MvcOptions>(options =>
{
    options.Filters.Add(new RequireHttpsAttribute());
});

however that will fail (404) if there is no ssl certificate. running directly from kestrel would be different than with IIS Express. With VS 2015 you can check the box in the project properties to use ssl and it will generate a self signed cert for you automatically for IIS Express

answered Jan 22 '17 at 20:53

Joe Audette

35,330
11
106
99

As stated above, trying this gives HTTP 404 on the home page. I did check the box in properties for the project, which is where I have the HTTPS port from. I also would prefer not to use Kestrel any further than it's already in the project if I can avoid it. I actually did follow the link you provided before posting, but I'm not getting the results Wildermuth implies. – Stanley Jointer II Jan 24 '17 at 22:18
As long as you run it in IISExpress the self signed cert should work. You do need to change the launch url to match the ssl url generated when you tick that box. The non-ssl url will give a 404 once you apply the filter so if you are still using that as the launch url that could be the problem – Joe Audette Jan 25 '17 at 13:21

score 0 · Answer 2 · answered Jan 22 '17 at 21:06

0

You could do what you are doing before app.UseStaticFiles();. Then any calls for files or MVC routes will be redirected to the secure version.

app.Use(async (context, next) =>
{
    if (context.Request.IsHttps)
        await next();
    else
    {
        var sslPortStr = ((sslPort == 0) || (sslPort == 443)) ? string.Empty : ($":{sslPort}");
        var sslUrl = $"https://{context.Request.Host.Host}{sslPort}{context.Request.Path}";
        context.Response.Redirect(sslUrl);
    }
});
app.UseStaticFiles();

app.UseMvc(routes =>
{
    routes.MapRoute(
        name: "default",
        template: "{controller=Home}/{action=Index}/{id?}");
});

I just wrote a small article on this as well: https://joonasw.net/view/enforcing-https-in-aspnet-core.

answered Jan 22 '17 at 21:06

juunas

54,244
13
113
149

When I do this, I get HTTP 404. – Stanley Jointer II Jan 24 '17 at 22:01
Sorry. For some reason, I can't edit the previous post. I get the HTTP 404 on the home page when I move the app.Use call anywhere before the app.UseMvc call. I did find either your link or a similar link that talked about creating a middleware. My issue with that is that I'm only trying to test at the moment. By all accounts, if I publish the site, the HTTPS will work given a valid certificate. Is there a way to add HTTPS solely for testing purposes? – Stanley Jointer II Jan 24 '17 at 22:10

score 0 · Answer 3 · answered Jan 23 '17 at 05:08

0

You can configure it when you add mvc.

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc(options =>
    {
        options.SslPort = 433; // your ssl port no
        options.Filters.Add(new RequireHttpsAttribute());
    });
}

answered Jan 23 '17 at 05:08

Ahmar

3,717
2
24
42

This also gives HTTP 404 on the home page. – Stanley Jointer II Jan 24 '17 at 22:07

ASP.Net Core: Where to put app.Use() call to force HTTPS

3 Answers3