This is the fourth of a new series of posts on ASP .NET Core. This week, we’ll be looking at the use of HTTPS in ASP .NET Core projects (using HTTP/1.1 today) and also HTTP/2 support for future ASP .NET Core projects.
HTTPS and SSL
If you’re reading this blog post, you’re probably familiar with HTTPS and the little lock symbol that appears on websites that have a valid SSL certificate. It’s actually TLS these days, and you can read more about SSL, TLS and HTTPS here:
Recently, the popular Google Chrome browser received an update that automatically displays a “Not Secure” message for any website that doesn’t use SSL. To address this, I updated this blog site to ensure that all embedded content use HTTPS when the site is loaded with HTTPS. I took it one step further and always enabled SSL so that site visitors going to WakeUpAndCode.com (with just HTTP) will be redirected to https://WakeUpAndCode.com.
This site is a WordPress site, so I was able to make the last change by installing a free plugin called Really Simple SSL.
If you’re not convinced you need SSL, just read this thread on Twitter:
I so often get re-explaining from others that "localhost doesn't need local https". eyeroll.
this is not universally true. this tweet thread is the last time i'm gonna explain. henceforth it will just be linked to.
— getify (@getify) July 28, 2018
EDIT: If you need another nudge in the right direction, here’s a gentle reminder from Troy Hunt, a well-known influential computer security expert in the Microsoft world. Troy highlights an anti-HTTPS debate that illustrates why it doesn’t make sense to be against it.
Ah, the memories! This just came across my timeline again today, I’ve since been blocked for this and those tweets were deleted. Some people are *really* passionate about (not using) HTTPS! https://t.co/2wcVrbX175
— Troy Hunt (@troyhunt) November 6, 2018
HTTPS in ASP .NET Core
For years, it has been too easy for ASP .NET developers to build Web Apps and Web APIs without any HTTPS during development. It wasn’t uncommon for web application developers to make excuses about not running their web apps with SSL on their local development environments, even if the application needed to be deployed to production with SSL (which production app doesn’t?).