[HTTPS][Docs] Confusing Advises in docs, please make it more clear to understand #35813
Description
Description
The documentation article is constantly switching between the advised way to do this (app.UseHtst() or app.UseHttpsRedirection()
- Info gotten: Htst is only a Browser advise:
Okay, so I would understand, we shall not use it, from this statement, especially if we may include mobile targets in the end of our solution 🤔
2. BUT using `app.UseHttpsRedirection()` will likly cause Cors Exeptions!
1. looking at a new created Blazor Web App + Server and `Individual Accounts` Identity *(assuming those MS provided Templates are following current standards)*, **we get http in our http ports**
```json
{
"$schema": "https://json.schemastore.org/launchsettings.json",
"profiles": {
"http": {
"commandName": "Project",
"dotnetRunMessages": true,
"launchBrowser": true,
"inspectUri": "{wsProtocol}://{url.hostname}:{url.port}/_framework/debug/ws-proxy?browser={browserInspectUri}",
"applicationUrl": "http://localhost:5233",
"environmentVariables": {
"ASPNETCORE_ENVIRONMENT": "Development"
}
},
"https": {
"commandName": "Project",
"dotnetRunMessages": true,
"launchBrowser": true,
"inspectUri": "{wsProtocol}://{url.hostname}:{url.port}/_framework/debug/ws-proxy?browser={browserInspectUri}",
"applicationUrl": "https://localhost:7226;http://localhost:5233",
"environmentVariables": {
"ASPNETCORE_ENVIRONMENT": "Development"
}
}
}
}
```
AND we get BOTH mentioned functions listed, while we are unconditionally to Hsts using app.UseHttpsRedirection()
Alright, so assuming we should even more avoid using app.UseHttpsRedirects() as it would likly throw errors!
3. Well... now reading that very next section NOW we are indeed advised, to even use BOTH of them??
you are driving me as reader insane 😵💫
Additionally, as this is also including the mention of a ReverseProxyConfiguration, could someone make that word a Link to a guide how or with what we can do that?
- And now here at the last parts of this page we are told again, that we shall not use Hsts in development:
So... sorry if its clear for you as experts, but for me the summary of this article is
Our list of choices is:
UseHttpsRedirection()UseHtst()
Your Advises:
- Do not define any http ports in your launchsettings
- Do not use
app.UseHttpsRedirection()as it will likly throw cors exceptions on you- BUT we tell you and provide it to you in our docs + Blazor template
- Our Template does also not define any Cors for this in exchange
- Do not use
app.UseHsts()in development
What should this also include
I would like to set this up correctly so I would not get the known cors / antiforgery header issues for a WebAssembly dotnet/runtime features using app + use https, and was advised to use this article page😅🤷
Page URL
Content source URL
https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/enforcing-ssl.md
Document ID
12ca0b9a-2638-a4ce-c45f-d4579c83dafb
Platform Id
e161f75c-cfd4-c97f-1775-dd3922db0100
Article author
Metadata
- ID: c7ddfb2f-5dea-5e31-2a27-02a4dc16104c
- PlatformId: e161f75c-cfd4-c97f-1775-dd3922db0100
- Service: aspnet-core
- Sub-service: security