Can I use HTTP instead of HTTPS to host MVC client to work with IdentityServer?

Question

I had my quickstart programs working on my local test environment: A MVC client accessing an API through IdentityServer. And this is all setup using HTTPS and self-host (Kestrel). What I am wondering is - can I host MVC in HTTP instead of HTTPS when working with IdentityServer? It doesn't seem matter if I change all parties to use HTTP or just MVC and leave the rest with HTTPS, as soon as I changed my MVC from https://localhost:5009 to http://localhost:5008 (in several places), the app failed with an error "invalid redirect uri".
Am I missing something, or is this simply something not allowed?

Answer 1

You can run over HTTP just fine during development, but in production you should always try to use HTTPS.

The error you get is because the RedirectURLs in the client definition in IdentityServer does not match the url of your client:

RedirectUris =
{
    "https://localhost:5001/...."
},

It is also recommended in the client to set this to false if you want to use HTTP when you define your OpenIDConnect options.

    /// <summary>
    /// Gets or sets if HTTPS is required for the metadata address or authority.
    /// The default is true. This should be disabled only in development environments.
    /// </summary>
    public bool RequireHttpsMetadata { get; set; } = true;

If you mange to get to the IdentityServer login page, then in the URL you will find the the redirectURL that is actually sent to IdentityServer. Or capture the request using fiddler to see what the requestUrl is that is passed to identityserver.

When I look at the screenshot, you have port 5009 in the allowedRedirectURis and 5008 in the request.