CODEWITHSUNDEEP
cookiesasp.net-corehttps
TheFogger
TheFogger

Reputation: 2429

How to make the cookie authentication middleware redirect to https URIs?

I am using cookie authentication without ASP.NET Core Identity. For unauthenticated requests, the middleware redirects the browser to a login page. The target URI of the redirect is always using the http scheme, even though the initial request is using HTTPS. I want the redirect to always use HTTPS, but I cannot figure out how to make that work.

Here is what I found so far:

  1. It works when I run Kestrel locally.
  2. It does not work on my web host.
  3. My web host is using IIS as a reverse proxy for kestrel.
  4. Https requests reach the hosted Kestrel as http.
  5. The cookie authentication middleware uses the request scheme to build the redirection URI. Because of 4) this always results in a redirect to an http-URI.

How do I resolve this? Can I configure IIS to use HTTPS to communicate with Kestrel or can I just somehow force the middleware to output https-URIs?

Upvotes: 0

Views: 309

Answers (1)

Edward
Edward

Reputation: 30046

For app.UseHttpsRedirection();, you need to specify the HTTPS Port.

Turn to launchSettings.json and change the iisSettings.iisExpress.sslPort to a valid port number like 44371.

If you fail to launch the project after specifying the port, try to Project Property->Debug->check Enable SSL->Save

Upvotes: 0

Related Questions