search

DuendeSoftware / Support

Support for Duende Software products
20 stars 0 forks source link

How can i disable HTTPS #1283

Closed odiab closed 2 weeks ago

odiab commented 1 month ago

Which version of Duende IdentityServer are you using? 7.0.4

Which version of .NET are you using? 8.0.6

How to disable HTTPS, and work only with HTTP for all projects IdentityServer, Api, WebClient

RolandGuijt commented 1 month ago

Can you give us some insight on why you want to disable https? I'm asking because disabling it would render IdentityServer and any other identity provider insecure since all http traffic can be monitored and intercepted.

odiab commented 1 month ago

We implement the IdentityServer locally on LAN, we don't have SSL and for some reason, we can not generate self-signed certificate

AndersAbel commented 4 weeks ago

The OpenID Protocol is designed with https and the https server authentication through certificates as the "trust anchor" for the entire system. It is clearly spelled out in the OIDC specification that https must be used for at least the discovery endpoint.

It might be technically possible to get IdentityServer running in a non-https-environment, but doing so would require in depth understanding of the consequences. It would also put very strict requirements on the security of the network to prevent sniffing of the clear-text traffic.

Could you share any more information on why it would not be feasible for you to enable https on your local LAN? Maybe we can help finding solutions (or convincing arguments) to get it implemented.

RolandGuijt commented 3 weeks ago

@odiab Did Anders' comment clear things up for you? If so I'd like to close.

RolandGuijt commented 2 weeks ago

Closing this, but feel free to reopen.