The following code calls UseHttpsRedirection in the Program.cs file: var builder = WebApplication.CreateBuilder(args) For more information, see Opt-out of HTTPS/HSTS on project creation. If the proxy server also handles writing HSTS headers (for example, native HSTS support in IIS 10.0 (1709) or later), HSTS Middleware isn't required by the app. If the proxy also handles HTTPS redirection, there's no need to use HTTPS Redirection Middleware. HSTS Middleware ( UseHsts) to send HTTP Strict Transport Security Protocol (HSTS) headers to clients.Īpps deployed in a reverse proxy configuration allow the proxy to handle connection security (HTTPS).HTTPS Redirection Middleware ( UseHttpsRedirection) to redirect HTTP requests to HTTPS.We recommend that production ASP.NET Core web apps use: Requests to an endpoint using HTTP that are redirected to HTTPS by UseHttpsRedirection fail with ERR_INVALID_REDIRECT on the CORS preflight request.ĪPI projects can reject HTTP requests rather than use UseHttpsRedirection to redirect requests to HTTPS. HTTP redirection to HTTPS causes ERR_INVALID_REDIRECT on the CORS preflight request The secure approach is to configure API projects to only listen to and respond over HTTPS. Even within browsers, a single authenticated call to an API over HTTP has risks on insecure networks. Other callers, such as phone or desktop apps, do not obey the instruction. The default API projects don't include HSTS because HSTS is generally a browser only instruction. For more information, see Use multiple environments in ASP.NET Core and 5 ways to set the URLs for an ASP.NET Core app by Andrew Lock.

To disable HTTP redirection in an API, set the ASPNETCORE_URLS environment variable or use the -urls command line flag. Close the connection with status code 400 (Bad Request) and not serve the request.Such clients may send information over HTTP. API clients may not understand or obey redirects from HTTP to HTTPS. RequireHttpsAttribute uses HTTP status codes to redirect browsers from HTTP to HTTPS. Do not use RequireHttpsAttribute on Web APIs that receive sensitive information.

Live edge wood san diego