Upgrade HTTP endpoints to HTTPS in Azure Container Apps by davidfowl · Pull Request #14267 · microsoft/aspire

davidfowl · 2026-01-31T06:59:33Z

Description

This PR changes how HTTP endpoints are handled when deploying to Azure Container Apps:

Problem:

HTTP→HTTPS redirect in ACA breaks WebSocket upgrade requests (they just fail)
Explicit ports like 8080 caused NotSupportedException at deploy time, even though they work fine for local dev
Developers had to manually adjust endpoint configs between dev and production

Solution:

HTTP endpoints are now automatically upgraded to HTTPS (port 443) by default
Explicit ports specified for development are treated as dev-only hints and normalized to 80/443
Removed NotSupportedException throws - instead logs informational messages
Added WithHttpsUpgrade(false) on the environment to opt out and preserve HTTP scheme

Usage:

// Default: HTTP endpoints upgraded to HTTPS
builder.AddAzureContainerAppEnvironment("env");

// Opt out: preserve HTTP scheme
builder.AddAzureContainerAppEnvironment("env")
    .WithHttpsUpgrade(false);

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
- No
Does the change require an update in our Aspire docs?
- Yes
- No

github-actions · 2026-01-31T06:59:43Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14267

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14267"

- HTTP endpoints are now upgraded to HTTPS:443 by default - Explicit dev ports (e.g., 8080) are treated as dev-only hints - Add WithHttpsUpgrade(false) to opt out at the environment level - Removes NotSupportedException throws for port validation

Copilot

Pull request overview

This PR addresses issues with HTTP endpoint handling in Azure Container Apps by automatically upgrading HTTP endpoints to HTTPS (port 443) by default, which prevents WebSocket upgrade failures caused by ACA's HTTP→HTTPS redirect behavior.

Changes:

HTTP endpoints are now automatically upgraded to HTTPS (port 443) by default when deploying to Azure Container Apps
Removed NotSupportedException for non-standard ports (8080, etc.), replacing with informational logging
Added WithHttpsUpgrade(false) method to opt out and preserve HTTP scheme when needed

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppEnvironmentResource.cs	Added internal `PreserveHttpEndpoints` property to control HTTP→HTTPS upgrade behavior
src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppExtensions.cs	Added public `WithHttpsUpgrade()` extension method to configure HTTP endpoint upgrade behavior
src/Aspire.Hosting.Azure.AppContainers/ContainerAppContext.cs	Modified endpoint processing logic to upgrade HTTP to HTTPS by default and log informational messages instead of throwing exceptions
tests/Aspire.Hosting.Azure.Tests/AzureContainerAppsTests.cs	Updated tests from expecting exceptions to verifying correct behavior; added test for HTTP preservation opt-out
tests/Aspire.Hosting.Azure.Tests/Snapshots/*.bicep	Updated snapshots to reflect HTTP→HTTPS upgrades in generated bicep (scheme, port, and environment variable values)

Comments suppressed due to low confidence (1)

src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppExtensions.cs:390

According to the XML Documentation Standards guideline 1000002, public APIs should include practical examples using the <example> tag. This method should include an example showing how to use WithHttpsUpgrade(false) to preserve HTTP endpoints, similar to how other public extension methods in the codebase provide usage examples (e.g., PublishAsAzureContainerApp methods have examples within their <remarks> sections).

    /// <summary>
    /// Configures whether HTTP endpoints should be upgraded to HTTPS in Azure Container Apps.
    /// By default, HTTP endpoints are upgraded to HTTPS for security and WebSocket compatibility.
    /// </summary>
    /// <param name="builder">The AzureContainerAppEnvironmentResource to configure.</param>
    /// <param name="upgrade">Whether to upgrade HTTP endpoints to HTTPS. Default is true.</param>
    /// <returns><see cref="IResourceBuilder{T}"/></returns>
    /// <remarks>
    /// When disabled (<c>false</c>), HTTP endpoints will use HTTP scheme and port 80 in Azure Container Apps.
    /// Note that explicit ports specified for development (e.g., port 8080) are still normalized
    /// to standard ports (80/443) as required by Azure Container Apps.
    /// </remarks>
    public static IResourceBuilder<AzureContainerAppEnvironmentResource> WithHttpsUpgrade(this IResourceBuilder<AzureContainerAppEnvironmentResource> builder, bool upgrade = true)
    {
        builder.Resource.PreserveHttpEndpoints = !upgrade;
        return builder;
    }

src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppExtensions.cs

- Log once per environment instead of per endpoint - Shows all affected resources/endpoints in one message - Example: 'HTTP endpoints will use HTTPS: keycloak:http, vault:http, app:http'

github-actions · 2026-01-31T07:18:09Z

🎬 CLI E2E Test Recordings

The following terminal recordings are available for commit 23cb11a:

Test	Recording
CreateAndDeployToDockerCompose	▶️ View Recording
CreateAndDeployToDockerComposeInteractive	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateEmptyAppHostProject	▶️ View Recording
CreateStartAndStopAspireProject	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording
PsCommandListsRunningAppHost	▶️ View Recording

_{📹 Recordings uploaded automatically from CI run #21540816187}

mitchdenny · 2026-02-01T07:41:27Z

Question about API granularity

The WithHttpsUpgrade() API is currently at the environment level, applying to all container apps. Should there also be a per-container app override?

For example:

// Current: environment-level only
builder.AddAzureContainerAppEnvironment("env")
    .WithHttpsUpgrade(false);

// Proposed addition: per-app override
builder.AddContainer("legacy-api", "myimage")
    .WithHttpEndpoint()
    .PublishAsContainerApp(options =>
    {
        options.PreserveHttpEndpoints = true;
    });

This would allow the environment to default to HTTPS upgrade while letting specific apps opt out individually. The precedence would be: per-app setting > environment setting > default (upgrade=true).

Is this level of granularity needed, or is environment-level sufficient for the intended use cases?

davidfowl · 2026-02-01T07:47:07Z

Yea I went back and forth on this but you can always use PublishAsContainerApp today to override everything and set ingress data at the bicep level. That's your escape hatch here, I don't think we need resource level logic.

davidfowl · 2026-02-02T07:19:09Z

/deployment-test

github-actions · 2026-02-02T07:19:18Z

🚀 Starting deployment tests on PR #14267...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

davidfowl requested a review from eerhardt as a code owner January 31, 2026 06:59

Copilot AI review requested due to automatic review settings January 31, 2026 06:59

Copilot started reviewing on behalf of davidfowl January 31, 2026 06:59 View session

davidfowl requested a review from mitchdenny January 31, 2026 07:00

davidfowl force-pushed the davidfowl/improve-aca branch from cdd10b4 to cec509a Compare January 31, 2026 07:03

Copilot AI reviewed Jan 31, 2026

View reviewed changes

src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppExtensions.cs Show resolved Hide resolved

Consolidate HTTPS upgrade logging to single message

23cb11a

- Log once per environment instead of per endpoint - Shows all affected resources/endpoints in one message - Example: 'HTTP endpoints will use HTTPS: keycloak:http, vault:http, app:http'

github-actions bot mentioned this pull request Jan 31, 2026

[pull requests] Review required #13834

Open

mitchdenny approved these changes Feb 1, 2026

View reviewed changes

github-actions bot temporarily deployed to deployment-testing February 2, 2026 07:24 Inactive

davidfowl merged commit 8748d92 into main Feb 2, 2026
340 checks passed

davidfowl deleted the davidfowl/improve-aca branch February 2, 2026 08:05

dotnet-policy-service bot added this to the 13.2 milestone Feb 2, 2026

github-actions bot locked and limited conversation to collaborators Mar 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade HTTP endpoints to HTTPS in Azure Container Apps#14267

Upgrade HTTP endpoints to HTTPS in Azure Container Apps#14267
davidfowl merged 2 commits intomainfrom
davidfowl/improve-aca

davidfowl commented Jan 31, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions bot commented Jan 31, 2026 •

edited

Loading

Uh oh!

mitchdenny commented Feb 1, 2026

Uh oh!

davidfowl commented Feb 1, 2026

Uh oh!

davidfowl commented Feb 2, 2026

Uh oh!

github-actions bot commented Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

davidfowl commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

github-actions bot commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

github-actions bot commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎬 CLI E2E Test Recordings

Uh oh!

mitchdenny commented Feb 1, 2026

Uh oh!

davidfowl commented Feb 1, 2026

Uh oh!

davidfowl commented Feb 2, 2026

Uh oh!

github-actions bot commented Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

davidfowl commented Jan 31, 2026 •

edited

Loading

github-actions bot commented Jan 31, 2026 •

edited

Loading

github-actions bot commented Jan 31, 2026 •

edited

Loading