Adds Https Redirection and Hsts Middlewares

aspnet / BasicMiddleware

[Archived] Basic middleware components for ASP.NET Core. Project moved to https://github.com/aspnet/AspNetCore

Apache License 2.0

169 stars 84 forks source link

Adds Https Redirection and Hsts Middlewares #264

Closed jkotalik closed 7 years ago

jkotalik commented 7 years ago

Implementation of #258. Final items:

Verify which browsers respect the Strict-Transport-Security and check behavior on browser.
Naming
Any design/ usability changes

cc @danroth27 @shirhatti @muratg

jkotalik commented 7 years ago

Per offline feedback, ~~HttpsEnforcement~~ -> HttpsPolicy for everything?

Tratcher commented 7 years ago

My standing suggestion is a top level config key / environment variable HttpsPort that would be set by VS when launching the process. VS is also the one setting URLs at startup.

jkotalik commented 7 years ago

We should consider making HttpsPolicy a shared options collection with RedirectToHttpsOptions and HstsOptions. To configure the HttpPolicy, if we require the max-age to be set, users will have to call services.Configure.

jkotalik commented 7 years ago

@javiercn @Tratcher We need to talk about how configuration options will be propagated to the middleware. Aka does this middleware need to do anything different or will configuration call app.UseHsts() or app.HttpsRedirection().

Tratcher commented 7 years ago

The current Options usage looks fine.