๐ฆ On NuGet: Recaffeinate.ApiSecurity
๐ Read more in my blog post: Enforce HTTPS correctly in ASP.NET Core APIs
It's easy to enforce HTTPS (with automatic redirects) in browser apps using the [RequireHttps]
attribute. However, the ASP.NET Core docs have this to say about using the attribute in API projects:
Do not use
RequireHttpsAttribute
on Web APIs that receive sensitive information.RequireHttpsAttribute
uses HTTP status codes to redirect browsers from HTTP to HTTPS. API clients may not understand or obey redirects from HTTP to HTTPS. Such clients may send information over HTTP.
Unfortunately there isn't a version of the attribute that closes or rejects the connection without redirecting. You can always enforce HTTPS at the API gateway or reverse proxy layer, but sometimes you want more control.
Use [RequireHttpsOrClose]
on controllers or actions to return HTTP code 400 (Bad Request) for insecure requests:
[RequireHttpsOrClose]
public class HomeController
Or, if you want to return a different status code:
[RequireHttpsOrClose(505)]
public class HomeController
Use the AbortIfNotHttps()
middleware if to reject all insecure (HTTP) requests across your entire application.
Place the middleware at the top of your Configure
method:
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
app.AbortIfNotHttps();
if (env.IsDevelopment())
// The rest of your pipeline...
}
Questions, comments, and PRs are welcome! Feel free to post an issue or ask me questions on Twitter.