Search code examples
asp.net-coreasp.net-identity.net-6.0

ASP.Net Identity Login Redirect Enforce Protocol (Https) Part 2 (.Net 6++)

Prior reference (.Net Framework/ASP.Net MVC): ASP.Net Identity Login Redirect Enforce Protocol (Https)

It seems this is still an "issue" in .Net 6+. There are cases where the return url constructed by the infrastructure results in an http scheme/protocol instead of https for oauth/external logins (Google, etc). This obviously fails because it must be https.

While I haven't gone deep into things, because I haven't found the source code for it (yet?), it's likely the same "issue" - at the app level, it doesn't "see" a https request (because SSL is offloaded somewhere) and therefore the url created "matches" the scheme/protocol, resulting in an http redirect url.

End of day, whatever hosting infrastrucutre/configuration my host has is in place is beyond my control. Therefore, the ultimate goal is to force https (hard code, skip/override whatever scheme/protocol check/eval in place).

There's nothing special in my setup and it's working fine in local/dev (https) testing. It's only when the application is finally hosted (production):

In startup program.cs this is the only related code I have for external login (along with the scaffolding/templates of the identity package):

builder.Services.AddDefaultIdentity<ApplicationUser>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddEntityFrameworkStores<my_db_context>();

builder.Services.AddAuthentication().AddGoogle(goog =>
{
    goog.ClientId = builder.Configuration["GoogleAuthClientId"];
    goog.ClientSecret = builder.Configuration["GoogleAuthClientSecret"];
});

The issue:

enter image description here

  • the origin is https
  • the redirect uri sent to Google Auth is http - this will always fail

Can anyone point me to relevant docs/source on how to add/override options in .Net 6 and above? (similar to prior implementations in .Net Framework/MVC)?

Solution

  • The answer is in the comment by @Tratcher:

    Official Ref: Configure ASP.NET Core to work with proxy servers and load balancers

    Essentially: ForwardedHeadersMiddleware

    For my specific case:

    In some cases, it might not be possible to add forwarded headers to the requests proxied to the app. If the proxy is enforcing that all public external requests are HTTPS, the scheme can be manually set before using any type of middleware:

    ...

app.Use((context, next) => {
context.Request.Scheme = "https";
return next(context); });

...