RequireHttpsAttribute with .NETCore RC2 causes HTTP302 redirect loop on Azure

Question

I've been trying to get a .NETCore RC2 web app working on Azure with the RequireHttpsAttribute set but I'm having issues.

To remove the possibility of this being a problem that I've introduced with my code, I cut things back to the bare minimum and recreated it using the "out of box" VS2015 .NETCore RC2 template.

If I deploy the standard VS2015 .NETCore RC2 web app the site runs fine. If I then add [RequireHttps] to the controllers it works fine locally, but on Azure it causes an HTTP302 redirect loop. This seems to be something which has changed since RC1 since the RequireHttpsAttribute works fine in Azure with RC1.

There is a similar question here: HTTP Error 310 ERR_TOO_MANY_REDIRECTS with RequireHttpsAttribute ASP.NET Core, but it's not clear if the question is talking about RC1 or RC2 (I actually suspect RC2), however the only answer is only applicable for RC1.

There is a similar question about this attribute causing a redirect loop on AWS here: RequireHttps causes redirect loop on Amazon Elastic Load Balancer but that is MVC4 and also mentions a header which isn't used by Azure.

Answer 1

There's currently a bug in Azure and ASP.NET Core RC2 which relates to how Kestrel and IIS are connected and the HTTPS header that says that it's an HTTPS request or not.

I understand that it might get solved soon on RTM since the bug is marked as Done.

A workaround we did is to use web.config to make a permanent redirect from any HTTP request to HTTPS. We use the dotnet-transform package to insert the redirect on Publish only (so locally on a dev environment it doesn't apply). This is optional if you need it as a FYI.

Answer 2

You can work around this by adding the following lines to ConfigureServices in Startup.cs (and add "using Microsoft.AspNetCore.HttpOverrides;")

services.Configure<ForwardedHeadersOptions>(options =>
        {
            options.ForwardedHeaders = ForwardedHeaders.XForwardedProto;
        });