Asp.net core 2.1 UseHttpsRedirection not working in IIS

Question

I deployed my asp.net core 2.1 WebApi to IIS 10. (The IIS worked as a proxy)

I have added a SSL cert in IIS and bindings for both insecure port (8081) and secure port (8082).

But when I visit http://localhost:8081/api/values, the browser just return me 403 Forbidden, not redirect me to https://localhost:8082/api/values.

My StartUp Code is as below:

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvc()
           .SetCompatibilityVersion(CompatibilityVersion.Version_2_1);

        services.AddHttpsRedirection(options=>
        {
            options.HttpsPort = 8082;
        });
    }


    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        //app.UseForwardedHeaders();
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseMvc();
    }

Answer 1

In my startup.cs i made this settings

public void ConfigureServices(IServiceCollection services)
{
    try
    {
        //..other codes

        services.AddHttpsRedirection(options =>
        {
            options.HttpsPort = 443;
        });
    }
    catch (Exception ex)
    {
        string innerMessage = "";
        if (ex.InnerException != null)
            innerMessage = ex.InnerException.Message;

        Log.Logger.Error("ConfigureServices Message: " + ex.Message + " inner Message:" + innerMessage + "Env.Name:" + _env.EnvironmentName);
    }
}

And in the Configure method, i used like this

        app.UseHttpsRedirection();

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
            app.UseHsts();
        }

Answer 2

In my case, the error was that I was calling things in an unsupported order. By rearranging my code to first call:

app.UserHttpsRedirection()

and then call

app.UseHsts()

it started to work instead of the other way around.

Answer 3

The issue I found was that a change from .net core 2.0 to .net core 2.1 meant that the https port needed to be specified explicitly in startup.cs

services.AddHttpsRedirection(options =>
    {
        options.HttpsPort = 443;
    });

See here for more info: https://github.com/aspnet/AspNetCore/issues/3176

Answer 4

You received this status code because you have selected Require SSL in SSL Settings.

If you want to use your code to redirect to https unchecked this option.

But first you should read carefully documentation: Enforce HTTPS in ASP.NET Core

Do not use RequireHttpsAttribute on Web APIs that receive sensitive information. RequireHttpsAttribute uses HTTP status codes to redirect browsers from HTTP to HTTPS. API clients may not understand or obey redirects from HTTP to HTTPS. Such clients may send information over HTTP. Web APIs should either:

• Not listen on HTTP.
• Close the connection with status code 400 (Bad Request) and not serve the request.