RequireHttps Attribute in ASP.NET MVC

Back to: ASP.NET MVC Tutorial

RequireHttps Attribute in ASP.NET MVC

In this article, I am going to discuss the RequireHttps Attribute in ASP.NET MVC Application with Examples. Please read our previous article, where we discussed the ValidateInput attribute in ASP.NET MVC.

What is RequireHttps Attribute in ASP.NET MVC?

The RequireHttps Attribute in ASP.NET MVC forces an unsecured HTTP request to be re-sent over HTTPS. Let’s understand [RequireHttps] attribute with an example. To understand this let’s create an empty MVC application with the name RequireHTTPsinMVC.

Set the local IIS to run this project:

Once you created the project, let’s set the local IIS to run this project.  To do so right-click on the project and click on properties, which will open the properties window for us. Then click on the web tab, Choose Local IIS, Check the Override application root URL checkbox and then click on Create Virtual Directory button as shown in the below image.

Once we click on the Create Virtual Directory button it will display a popup as shown below

Just click OK, and it will create the application in IIS.

Note: You have to run the visual studio in Administrator mode to do so otherwise it will not all you to create the virtual directory in IIS.

How to see the website in IIS?

Open the Run window. Type inetmgr and click ok, it will open IIS as shown below

To see our application just expand the node as shown below

Save the application and run the application from the visual studio. If you are getting the below error, then you need to install a few windows configuration things.

1. Open Run Window
2. in the Run Window, enter “OptionalFeatures.exe”
3. in the features window, Click: “Internet Information Services”
4. Click: “World Wide Web Services”
5. Click: “Application Development Features”
6. Check the features.

Now again run the application.

If you are getting below Access is Denied error then do the following things.

Right-click on your project in IIS and click on Edit Permission as shown below.

Once we click on the Edit Permission the following popup will open. Select the Security tab as shown below.

Then select User and click on Edit button which will open the below popup.

Select Users from Group or user names section, then check all the checkboxes in the Allow section, then click on Apply and then OK. Then click OK. Run the application and navigate to /Home/Index and it will work as expected.

Let’s run the application using the HTTPS protocol

https://localhost/RequireHTTPsinMVC/Home/Index

When we run the application it will give us the below error

To run the application using Https we need SSL Certificate.

What are self-signed certificates?

A self-signed certificate is an identity certificate that is signed by its own creator. Certificates are signed by Certificate Authority. In general self-signed certificates are fine for testing purposes and not for production use.

Creating self-signed certificates

There are several ways to create self-signed test certificates. Let us explore the easier options available. The easiest and simpler approach is to use IIS to create these certificates.

In IIS

1. Click on the “Server Name” as shown below

2. Double click on “Server Certificates” feature

Once we double click just go to the right-side panel as shown below

3. Click on the “Create Self Signed Certificate” link, under “Actions” which will open the below popup.

4. Specify a friendly name for the certificate and click OK.

The friendly name is not part of the certificate itself but is used by the server administrator to easily distinguish the certificate.  Once we click on the Ok button the SSL certificate will be added to the Server Certificate list as shown below.

The next step is to Add HTTPS site binding if it is not already present. Open IIS

Expand the “Server Name”

Expand “Sites”

Select “Default Web Site”

Click “Binding” under “Edit Site” in the “Actions” pane as shown below.

Once we click on Bindings it will open the below popup

In the “Site Bindings” window, click “Add”

Once we click on the Add button the below popup will open

Select Type = “https” and the SSL Certificate as MyTestSSLCertificate and click “OK”. Click “Close” on the “Site Bindings” window. At this point, we will be able to access our application using both HTTP and HTTPS protocol. When the site is accessed over HTTPS, we may receive a browser warning about the authenticity of the website as shown below.

Then click on the ADVANCED option and then click on Proceed to localhost (unsafe) and it will display our page as expected. Suppose our requirement is to automatically transfer the Http request to Https then we need to decorate RequireHttps attribute either in the action method or in the controller level as shown below.

[RequireHttps]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
    public ActionResult About()
    {
        ViewBag.Message = "Your application description page.";
        return View();
    }
    public ActionResult Contact()
    {
        ViewBag.Message = "Your contact page.";
        return View();
    }
}

Now run the application and see it autumnally transferred the HTTP request to https request.

In the next article, I am going to discuss Custom Action Filter in MVC Application. Here, In this article, I try to explain the RequireHttps Attribute in ASP.NET MVC application step by step with a real-time example. I hope this article will help you with your need. I would like to have your feedback. Please post your feedback, question, or comments about this article.