HTTPS carries HTTP over a TLS-protected connection, preventing intercepted requests and responses from being read or tampered with. Its secure connection requires a certificate: public services need one from a trusted authority, while development can use the .NET CLI development certificate. section 9.3 section 9.0
Configure HTTPS differently for development and production:
- Install and trust a development certificate with `dotnet dev-certs https --trust`. section 9.3
- Redirect HTTP requests with `app.UseHttpsRedirection();`; an HTTP request receives a 307 temporary redirect and a `Location` header containing the HTTPS URL. section 9.3
- Avoid exposing an HTTP port in production by terminating HTTPS at a proxy, or permanently redirect HTTP to HTTPS. section 9.3
- Enable HSTS in production so browsers record that the site should use HTTPS instead of repeatedly testing HTTP. section 9.3
Listing 9.3 Enabling HSTS in production
var app = builder.Build();
if (app.Environment.IsProduction()) #1
{
app.UseHsts(); #2
}
The production guard and `app.UseHsts()` pattern shows where HSTS belongs in an ASP.NET Core pipeline; complementary configuration can preload the policy, include subdomains, set a one-year lifetime, and exclude a test host. section 9.3
