建议的方法是将所有不安全的传入请求重定向到HTTPS。我是否需要编写中间件组件?如果是这样,我无法弄清楚如何获取服务器名称。
public class RedirectHttpMiddleware
{
RequestDelegate _next;
public RedirectHttpMiddleware(RequestDelegate next)
{
_next = next;
}
public async Task Invoke(HttpContext context)
{
if (context.Request.IsSecure)
await _next(context);
else
{
var server = ""; // How do I get the server name?
context.Response.Redirect("https://" + server + context.Request.Path);
}
}
}
您可以使用自己的中间件类,但通常我只是在我的启动配置中执行以下操作:
app.Use(async (context, next) =>
{
if (context.Request.IsHttps)
{
await next();
}
else
{
var withHttps = Uri.UriSchemeHttps + Uri.SchemeDelimiter + context.Request.Uri.GetComponents(UriComponents.AbsoluteUri & ~UriComponents.Scheme, UriFormat.SafeUnescaped);
context.Response.Redirect(withHttps);
}
});
这样做只是抓取整个URL,查询字符串和所有,并使用GetComponents
来获取除URL中的方案之外的所有内容。然后HTTPS方案被添加到组件URL之前。
这将适用于完整的.NET Framework,对于ASP.NET Core,您可以执行以下操作:
app.Use(async (context, next) =>
{
if (context.Request.IsHttps)
{
await next();
}
else
{
var withHttps = "https://" + context.Request.Host + context.Request.Path;
context.Response.Redirect(withHttps);
}
});
这会将主机和路径附加到HTTPS方案。您可能还想添加其他组件,例如查询和哈希。
我喜欢使用编译器指令的属性
<rewrite>
<rules>
<rule name="HTTP/S to HTTPS Redirect" enabled="true" stopProcessing="true">
<match url="(.*)" />
<conditions logicalGrouping="MatchAny">
<add input="{SERVER_PORT_SECURE}" pattern="^0$" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>
</rules>
</rewrite>
对于.NET Core 2.0及更低版本(official docs for 2.0):
使用[RequireHttps]
属性/过滤器。您可以对控制器执行此操作:
[RequireHttps]
public class AccountController {
}
或者在Startup.cs
方法中将其添加到ConfigureServices
中:
services.Configure<MvcOptions>(options =>
{
options.Filters.Add(new RequireHttpsAttribute());
}
另外,我只是想补充一点,vcsjones的答案也是正确的,但你需要确保在配置的早期添加此代码,然后再导致导致重定向的任何其他中间件/代码。就我而言,我在添加Identity Framework中间件之前添加了它。
完整的答案是1号,但不要停在那里设置HTTPS,进行额外的步骤:
1 - 然后我们使用RequireHttpsAttribute
重定向到HTTPS并在MVC选项中设置SSL端口。我们也在从launchSettings.json读取SSL端口,但我们只需要在开发模式下使用它。
2 - 使用AddAntiforgery
在防伪令牌上要求HTTPS。
3 - 使用NWebsec.AspNetCore.Middleware
NuGet包和UseHsts
方法在整个站点启用严格传输安全性(HSTS)。不要忘记在下面添加Preload并将您的网站提交给HSTS Preload site。更多信息here和here。
4 - 使用NWebsec.AspNetCore.Middleware
NuGet包和UseHpkp
方法在整个站点上启用公钥锁定(HPKP)。请注意,如果您犯了这个错误,那么您基本上就是在做您的网站。更多信息here和here。
5 - 在任何使用的URL中包含https方案。 Content Security Policy (CSP) HTTP标头和Subresource Integrity (SRI)在某些浏览器中模仿该方案时效果不佳。最好明确HTTPS。例如
<script src="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.4/bootstrap.min.js"></script>
6-使用ASP.NET MVC Boilerplate Visual Studio项目模板生成一个包含所有这些内置项目的项目。您还可以在GitHub上查看代码。
完成上述所有操作后,您的Startup
类看起来应该是这样的:
public class Startup
{
private readonly int? sslPort;
public Startup(IHostingEnvironment hostingEnvironment)
{
if (hostingEnvironment.IsDevelopment())
{
var launchConfiguration = new ConfigurationBuilder()
.SetBasePath(hostingEnvironment.ContentRootPath)
.AddJsonFile(@"Properties\launchSettings.json")
.Build();
// During development we won't be using port 443.
this.sslPort = launchConfiguration.GetValue<int>("iisSettings:iisExpress:sslPort");
}
}
public void ConfigureServices(IServiceCollection services)
{
services
.AddAntiforgery(options =>
{
options.RequireSsl = true;
});
.AddMvc(options =>
{
options.Filters.Add(new RequireHttpsAttribute());
options.SslPort = sslPort;
});
}
public void Configure(IApplicationBuilder application)
{
application
.UseHsts(options => options.MaxAge(days: 18 * 7).IncludeSubdomains().Preload())
.UseHpkp(options => options
.Sha256Pins(
"Base64 encoded SHA-256 hash of your first certificate e.g. cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=",
"Base64 encoded SHA-256 hash of your second backup certificate e.g. M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=")
.MaxAge(days: 18 * 7)
.IncludeSubdomains())
.UseCsp(options => options
.UpgradeInsecureRequests(this.sslPort.HasValue ? this.sslPort.Value : 443))
.UseMvc();
}
}
如果你想在.NET Core的DEV环境中获取端口,请查看env.IsDevelopment()
并有条件地从launchSettings.json
获取SSL端口。
if (env.IsDevelopment())
{
var builder = new ConfigurationBuilder()
.SetBasePath(env.ContentRootPath)
.AddJsonFile(@"Properties/launchSettings.json", optional: false, reloadOnChange: true);
var launchConfig = builder.Build();
sslPort = launchConfig.GetValue<int>("iisSettings:iisExpress:sslPort");
}
`
抓取SSL端口后,您可以将端口合并到@vcsjones发布的解决方案中。
总是Https Middleware.vs,qazxsw poi
inspired by RequiresHttpsAttribute.
Startup.cs
using System;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
public class AlwaysHttpsMiddleware
{
private readonly RequestDelegate _next;
public AlwaysHttpsMiddleware(RequestDelegate next)
{
_next = next;
}
public async Task Invoke(HttpContext context)
{
if (context.Request.IsHttps)
{
await _next.Invoke(context);
}
else
{
var request = context.Request;
// only redirect for GET requests, otherwise the browser might
// not propagate the verb and request body correctly.
if (!string.Equals(request.Method, "GET", StringComparison.OrdinalIgnoreCase))
{
context.Response.StatusCode = StatusCodes.Status403Forbidden;
await context.Response.WriteAsync("This site requires HTTPS.");
}
else
{
var newUrl = string.Concat(
"https://",
request.Host.ToUriComponent(),
request.PathBase.ToUriComponent(),
request.Path.ToUriComponent(),
request.QueryString.ToUriComponent());
context.Response.Redirect(newUrl);
}
}
}
}
我修改了一下@vcsjones的答案,在dev环境中使用自定义端口。同时归功于@ long2know。
public void Configure(IApplicationBuilder app)
{
if (_env.IsProduction())
{
app.UseMiddleware<AlwaysHttpsMiddleware>();
}
}
这必须出现在app.UseStaticFiles或app.UseMvc之前,否则将被忽略。
请注意,该端口应取自app.Use(async (context, next) =>
{
var request = context.Request;
if (request.IsHttps)
{
await next();
}
else
{
var devPort = Configuration.GetValue<int>("iisSettings:iisExpress:sslPort");
var host = env.IsDevelopment() && devPort > 0
? new HostString(request.Host.Host, devPort)
: new HostString(request.Host.Host);
string newUrl = $"https://{host}{request.PathBase}{request.Path}{request.QueryString}";
context.Response.Redirect(newUrl, true);
}
});
文件,因此您还应将此文件添加到launchSettings.json
中的ConfigurationBuilder
:
Startup.cs
在ASP.NET Core 2.1中,只需使用:
.AddJsonFile(@"Properties/launchSettings.json", optional: false, reloadOnChange: true)
这里有一些很好的答案,但我需要一个可以使用或不使用IIS的解决方案,也不需要在本地调试期间更改协议。我在Startup.Configure方法中将AD auth添加到管道后添加了这个。这是完整的框架。此处的其他解决方案概述了如何重建Core的URL。
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Error");
app.UseHsts(); // <-- Add this !!!!!
}
app.UseHttpsRedirection(); // <-- Add this !!!!!
app.UseStaticFiles();
app.UseCookiePolicy();
app.UseMvc();
}
为了让您的DOTNet Core应用程序在HTTPS下运行,需要遵循以下三个步骤:
app.Use(async (context, next) =>
{
if (context.Request.IsHttps || // Handles https straight to the server
context.Request.Headers["X-Forwarded-Proto"] == Uri.UriSchemeHttps || // Handles an IIS or Azure passthrough
context.Request.Host.ToString().StartsWith("localhost",true, System.Globalization.CultureInfo.InvariantCulture) || // Ignore for localhost
context.Request.Headers["X-Forwarded-Proto"].Contains( Uri.UriSchemeHttps )) // X-Forwarded-Proto can have multiple values if there are multiple proxies
{
await next();
}
else
{
var withHttps = Uri.UriSchemeHttps + Uri.SchemeDelimiter + context.Request.Host + context.Request.Path + context.Request.QueryString;
context.Response.Redirect(withHttps);
}
});
输入所需的https端口services.Configure<MvcOptions>(options =>
{
options.SslPort = 44390;
options.Filters.Add(new RequireHttpsAttribute());
});