Force HTTPS in ASP.Net Web API

TL;DR

This guide shows you how to automatically redirect all HTTP requests to HTTPS for your ASP.Net Web API, ensuring secure communication.

Steps

1. Understand the Goal: We want anyone trying to access your website using http:// to be automatically sent to https://. This is crucial for cyber security and protecting user data.
2. Check Your SSL Certificate: Before you start, make sure you have a valid SSL certificate installed on your web server. Without this, HTTPS won’t work! You’ll usually get this from a Certificate Authority (like Let’s Encrypt or DigiCert). Your hosting provider can help with installation if needed.
3. Modify the Web.config File: Open your Web.config file. This is where we’ll add rules to handle HTTP redirects.
   • Locate the <system.webServer> section.
   • Within this, find or create the <httpRedirect> element. If it doesn’t exist, add it.
   • Add a rule to redirect all HTTP requests to HTTPS. Here’s an example:

     <httpRedirect enabled="true" mode="RedirectToHttps" httpStatusCode="MovedPermanently"/>

4. Explanation of the Web.config Rule:
   • enabled="true": Turns the redirect feature on.
   • mode="RedirectToHttps": Specifies that we want to redirect to HTTPS.
   • httpStatusCode="MovedPermanently": Tells browsers and search engines this is a permanent change, which helps with SEO. Using 301 (Moved Permanently) is best practice.
5. Test the Redirect: After saving your changes to Web.config, restart your web application or IIS server. Then, try accessing your website using http://. You should be automatically redirected to https://. Check your browser’s address bar to confirm.
   • If the redirect doesn’t work immediately, clear your browser cache and cookies.
6. (Optional) Redirect Specific URLs: If you need more control (e.g., only redirect certain pages), you can use URL Rewrite rules within Web.config. This is a bit more advanced, but allows for finer-grained redirection.

   <rule name="Redirect HTTP to HTTPS" stopProcessing="true">
     <match url="(.*)" />
     <conditions logicalOr="false">
       <add input="{HTTPS}" pattern="^off$" ignoreCase="true" />
     </conditions>
     <action type="Redirect" url="https://{REQUEST_URI}" redirectType="Permanent" />
   </rule>

7. (Optional) Global.asax for older frameworks: For ASP.Net applications not using Web.config redirects, you can implement the redirect in your Global.asax file within the Application_BeginRequest method.

   protected void Application_BeginRequest(object sender, EventArgs e)
   {
       if (HttpContext.Current.Request.IsSecureConnection == false) {
           string url = "https://" + HttpContext.Current.Request.Url.Host + HttpContext.Current.Request.RawUrl;
           Response.Redirect(url, true);
       }
   }