Benutzer:MovGP0/ASP.NET Core/HTTPS

MovGP0

Über mich

Hilfen

Artikel

Weblinks

Literatur

Zitate

Notizen

Programmierung

MSCert

Physik

Programmierung ASP.NET Common OWIN • Razor • WebForms • MVC • WebAPI Core Configuration • Data Protection API • Dependency Injection • Routing Attack Vectors HTTPS • HSTS • HPKP • CSP • CSRF • Anti-XSS • CORS • Open Redirection • Click-Jacking Libraries OpenID • Azure AD

Enforcing HTTPS

Custom Middleware

• Implement Middleware that redirects to HTTPS when HTTP is used

EnforceHttpsMiddleware.cs

public sealed class EnforceHttpsMiddleware
{
    private RequestDelegate Next { get; }

    public EnforceHttpsMiddleware(RequestDelegate next)
    {
        Next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        HttpRequest request = context.Request;
        if (request.IsHttps) await Next(context);
        var url = ConvertToHttpsUri(request).ToString();
        context.Response.Redirect(url, permanent: true);
    }

    private Uri ConvertToHttpsUri(HttpRequest request)
    {
        // URL has the form
        // scheme://user:password@host:port/path#fragment?querystring
        // user and password are not needed here

        using(var builder = new UriBuilder())
        {
            builder.Scheme = "https";
            builder.Host = request.Host;
            builder.Port = request.Port;
            builder.Path = request.Path;
            builder.Fragment = request.Fragment; 
            builder.Query = request.QueryString;
            return builder.Uri;
        }
    }
}

AppBuilderExtensions.cs

public static class AppBuilderExtensions
{
    public static IApplicationBuilder UseHttpsEnforcement(this IApplicationBuilder app)
    {
        if (app == null) throw new ArgumentNullException(nameof(app));
        return app.UseMiddleware<EnforceHttpsMiddleware>();
    }
}

Startup.Configure

if (env.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
    app.UseBrowserLink();
}
else
{
    app.UseHttpsEnforcement();
}

Using ASP.NET Core MVC

using Microsoft.AspNetCore.Mvc;

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<MvcOptions>(options =>
    {
        options.Filters.Add(new RequireHttpsAttribute()); // assume every controller has [RequireHttps] attribute
    });
    // ...
}

using Microsoft.AspNetCore.Rewrite;

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    loggerFactory.AddConsole(Configuration.GetSection("Logging"));
    loggerFactory.AddDebug();

    var options = new RewriteOptions()
       .AddRedirectToHttps();
    // ...
}

Quellen

• Joonas Westlin: Enforcing HTTPS in ASP.NET Core. 21. Januar 2017, abgerufen am 12. Mai 2017 (englisch). 
• Enforcing SSL in an ASP.NET Core app. 19. März 2017, abgerufen am 12. Mai 2017 (englisch). 

Weblinks

• Let's Encrypt. Abgerufen am 12. Mai 2017 (englisch). 
• Nik Molnar: "Let's Encrypt" Azure Web Apps the Free and Easy Way. Abgerufen am 15. Mai 2017 (englisch). 
• Rick Strahl: Using Let's Encrypt with IIS on Windows. 22. Februar 2016, abgerufen am 15. Mai 2017 (Beispiel für Let's Encrypt mit ACMESharp (PowerShell)). 
• Domain registration with Hover.com

|}