Query String Parameters Stripped When Using HTTP but Not HTTPS

[aarondglover]

Description:
I've observed an unexpected behavior in my .NET Aspire project where query string parameters are stripped when accessing the endpoint via HTTP but are preserved when using HTTPS. Here are the details:

Environment: .NET 9, ASP.NET Core within a .NET Aspire project.
Scenario:
When I make a GET request to http://localhost:port/api/endpoint?parameter=value, the query string parameters are not present in context.Request.QueryString or when bound to controller action parameters.
Conversely, when I access the same endpoint using https://localhost:port/api/endpoint?parameter=value, the query parameters are correctly available.

Questions:

Is this expected behavior? - Is there a reason why query string parameters would be stripped when not using HTTPS?
Can this behavior be configured? - If this is by design, is there a way to configure or override this behavior to ensure query strings are preserved over HTTP connections as well?
Documentation Reference - Is this behavior documented anywhere in the official .NET Aspire or ASP.NET Core documentation? I couldn't find any mention of this specific scenario.

Additional Context:

My project uses the standard setup provided by .NET Aspire with no custom middleware for query string handling or URL rewriting.
I've checked for any redirect rules or middleware that might affect HTTP requests differently than HTTPS, but found none explicitly doing so.

Steps to Reproduce:

Set up a new .NET Aspire project with a simple GET endpoint that logs or returns query parameters.
Access the endpoint via HTTP and HTTPS, comparing how query parameters are handled.

Any insights or guidance on this would be greatly appreciated.

[davidfowl]

Is that because you have https redirection turned on in the application? Can you share a repro?

[aarondglover]

Hi @davidfowl
I do NOT have https redirection enabled. I assume you mean something like

app.UseHttpsRedirection();

In my program.cs ?

[davidfowl]

Correct. If you can provide a repro that would be great!

[aarondglover]

Well this is frustrating.

I can not reproduce it anymore. It doesn't even seem to be a problem in my original project or my minimal repro.

The only action i took was to completely close down VS2022 and reopen it. Perhaps that cleared some state.

i even configured some middleware to capture it. Every single time it ran, the querystring was ""...

app.Use((context, next) =>
{
    if (context.Request.Query.TryGetValue("includeRelatedEntities", out var value))
        Console.WriteLine($"Query string 'includeRelatedEntities' value: {value}");

    return next();
});

And I'm going to assume the answers to my questions are as follows:

Is this expected behavior? NO
Can this behavior be configured? NO - its not behaviour of aspire
Documentation Reference - NOT DOCUMENTED as its not a thing

Sorry to have bothered you :( Must have been a visual studio glitch.

[aarondglover]

i found the issue. I was using SwaggerUi.Aspire.Hosting - the issue was not to do with http/https but rather if I accessed the API via the swaggerUI resource the httpforwarding was dropping the query string parameters. I made pull request in your project @davidfowl