Error message when hosting

[omidkrad]

Hi, I use MVC Boilerplate and it works fine when running the app locally. However, when the app is hosted, I get the following error message:

Mixed Content: The page at 'https://mydomain.com/api/summary?id=...' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://mydomain.com/error/internalservererror/?500;https://mydomain.com/api/summary?id=...'.
This request has been blocked; the content must be served over HTTPS.
XHR failed loading: GET "https://mydomain.com/api/summary?id=...".

We have a valid SSL and when the location is HTTPS, the JS code makes a JQuery.ajax call with url set to /api/summary?id=.... It looks like there is a server error and the MVC boilerplate is trying to redirect to the error page but with the wrong schema. The Mixed Content error seems to be produced in the browser. Do you have any idea why this is happening? I have to try to debug why it's failing on the server but the same web api added to a regular MVC template does not produce the error. I also tried to disable all boilerplate security filters to no avail. Thanks!

[RehanSaeed]

The RedirectToCanonicalUrlAttribute and RequireHttpsAttribute cause redirects for SEO and security purposes. You can read comments about what they do.

Are you trying to build an API and Website in one? I wouldn't recomend that as it's difficult to separate the two e.g.

1. API's have different error pages. You don't want to return a web page when there is a 500 internal server error.
2. The RedirectToCanonicalUrlAttribute may mess things up if you require case sensitive URL's but you can use the NoLowercaseQueryStringAttribute or NoTrailingSlashAttribute to workaround some of this.

[omidkrad]

Yes we have a mixed MVC and WebAPI project. Do we need to host two separate apps if we separate them? Do you know if mixed MVC and WebAPI scenario works any better in ASP.NET Core?

[RehanSaeed]

I asked this very question on StackOverflow 'Using Web API inside a ASP.NET 5 MVC 6 Application'. I tried a few ways and it is not that easy to separate. I already mentioned two of the problems above a few other problems might be:

1. Setting up Swagger (Called Ahoy for ASP.NET Core). This is a big one for me. Swagger is so easy to implement.
2. You might want different formatters.
3. You might want different filters.

One way I did not try that RC2 makes possible is including two Startup classes and starting both in one project. From a hosting perspective, I can see why you would want to go this way as it halves the costs.

[RehanSaeed]

There is a basic API project template that has not been released yet in the Boilerplate solution. It is still based on Beta 8. Need to update it and get it released. The intention is to implement Swagger by default.

[omidkrad]

Thanks for your hints @RehanSaeed. I also asked my host, AppHarbor, about this and it looks like the way some URLs are resolved in the MVC Boilerplate does not play well with their nginx load balancer. The load balancer is listening on port 80 and 443, but backend workers are using different ports than that. So when generating URLs in the app we should change them back to public ports 80 or 443 depending on the current HTTP Schema. The code in the boilerplate that is generating URL might be in the boilerplate's nuget package and I'm not sure where this is happening. I'll update here if I could figure it out.

[omidkrad]

I think issue #69 is related I had to disable call to RedirectToCanonicalUrlAttribute to get this working.

[omidkrad]

I followed up with AppHarbor and they pointed me to this OWIN middleware that can be used to rewrite the request context at an earlier stage than the filter configuration is executed.

Also they said it would be great if MVC Boilerplate could support the X-Forwarded-Proto header out of the box as it is also pretty standard.

[RehanSaeed]

Redirecting from HTTP to HTTPS does not work in RC1 when you do not use the default port 80 to 443. This is a problem with Microsoft's code. RC 2 added a way to redirect to HTTPS with a custom port that you can specify. Is this the problem you are having? I'm a bit unclear about what I need to do to get this issue cleared.