RequireHttps Attribute in MVC

RequireHttps attribute in ASP.NET MVC

In this article, I will discuss RequireHttps attribute in MVC with a simple example. 

The RequireHttps attribute forces an unsecured HTTP request to be re-sent over HTTPS. Let’s understand [RequireHttps] attribute with an example. 

To understand this let’s create an empty MVC application.

Open Visual Studio in Administrator mode and create a new project

Select File => New => Project

RequireHttps attribute in ASP.NET MVC

After clicking on “Project” link a new dialog will pop up.

In that we are going to select web templates from the left pane after selecting web template, we need to select the web template as “ASP.NET Web Application” as shown below.

RequireHttps attribute in ASP.NET MVC

After selecting this project template next we are going to name the project as “RequireHTTPsinMVC” and clicking on the OK button a new dialog will pop up with Name “New ASP.NET Project” for selecting project Templates.

RequireHttps attribute in ASP.NET MVC

In this dialog, we are going to choose MVC project template and then we are going to choose Authentication type for doing that just click on Change Authentication button, a new dialog will pop up with the nameChange Authentication” here we are going to choose No Authentication click on OK Button.

It will take some to time create the project for us. Once the project is created let’s see the folder structure as shown below

RequireHttps attribute in ASP.NET MVC

In the next step let’s set the local IIS to run this project.

To do so right click on the project and click on properties, which will open the properties window for us as shown below.

Then click on the web tab, Choose Local IIS, Check the Override application root URL checkbox and then click on Create Virtual Directory button as shown below.

RequireHttps attribute in ASP.NET MVC

Once we click on the Create Virtual Directory button it will display a popup as shown below

RequireHttps attribute in ASP.NET MVC

Just click OK, and it will create the application in IIS.

Note: You have to run the visual studio in Administrator mode to do so otherwise it will not all you to create the virtual directory in IIS.

How to see the website in IIS?

Open Run window

Type inetmgr and click ok, it will open IIS as shown below

RequireHttps attribute in ASP.NET MVC

To see our application just expand the node as shown below

RequireHttps attribute in ASP.NET MVC

Save the application and run the application from visual studio.

If you are getting the below error, then you need to install a few windows configuration things.

RequireHttps attribute in ASP.NET MVC

  1. Open Run Window
  2. in the Run Window, enter “OptionalFeatures.exe”
  3. in the features window, Click: “Internet Information Services”
  4. Click: “World Wide Web Services”
  5. Click: “Application Development Features”
  6. Check the features.
Now again run the application.

If you are getting below Access is Denied error then do the following things.

RequireHttps attribute in ASP.NET MVC

Right click on your project in IIS and click on Edit Permission as shown below.

RequireHttps attribute in ASP.NET MVC

Once we click on the Edit Permission the following popup will open. Select the Security tab as shown below.

RequireHttps attribute in ASP.NET MVC

Then select User and click on Edit button which will open the below popup.

RequireHttps attribute in ASP.NET MVC

Select Users from Group or user names section, then check all the checkboxes in Allow section, then click on Apply and then OK.

Then click OK.

Run the application and navigate to /Home/Index and it will work as expected.

Let’s run the application using Https protocol

https://localhost/RequireHTTPsinMVC/Home/Index

When we run the application it will give us the below error

RequireHttps attribute in ASP.NET MVC

To run the application using Https we need SSL Certificate.

What are self-signed certificates?

A self-signed certificate is an identity certificate that is signed by its own creator. Certificates are signed by Certificate Authority. In general self-signed certificates are fine for testing purposes and not for production use.

Creating self-signed certificates

There are several ways to create self-signed test certificates. Let us explore the easier options available. The easiest and simpler approach is to use IIS to create these certificates.

In IIS

1. Click on the “Server Name” as shown below

RequireHttps attribute in ASP.NET MVC

2. Double click on “Server Certificates” feature

RequireHttps attribute in ASP.NET MVC

Once we double click just go to the right side panel as shown below

RequireHttps attribute in ASP.NET MVC

3. Click on “Create Self Signed Certificate” link, under “Actions” which will open the below popup.

RequireHttps attribute in ASP.NET MVC

4. Specify a friendly name for the certificate and click OK.

RequireHttps attribute in ASP.NET MVC

The friendly name is not part of the certificate itself but is used by the server administrator to easily distinguish the certificate. 

Once we click on the Ok button the SSL certificate will be added to the Server Certificate list as shown below.

RequireHttps attribute in ASP.NET MVC

The next step is to Add HTTPS site binding if it is not already present.

Open IIS

Expand the “Server Name”

Expand “Sites”

Select “Default Web Site”

Click “Binding” under “Edit Site” in “Actions” pane as shown below.

RequireHttps attribute in ASP.NET MVC

Once we click on Bindings it will open the below popup

RequireHttps attribute in ASP.NET MVC

In the “Site Bindings” window, Click “Add”

Once we click on the Add button the below popup will open

RequireHttps attribute in ASP.NET MVC

Select Type = “https” and the SSL Certificate as MyTestSSLCertificate and click “OK”

Click “Close” on “Site Bindings” window

At this point, we will be able to access our application using both HTTP and HTTPS protocol. When the site is accessed over HTTPS, we may receive a browser warning about the authenticity of the website as shown below.

RequireHttps attribute in ASP.NET MVC

Then click on the ADVANCED option and then click on Proceed to localhost (unsafe) and it will display our page as expected.

Suppose our requirement is to automatically transfer the Http request to Https then we need to decorate RequireHttps attribute either in the action method or in the controller level as shown below

[RequireHttps]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
    public ActionResult About()
    {
        ViewBag.Message = "Your application description page.";
        return View();
    }
    public ActionResult Contact()
    {
        ViewBag.Message = "Your contact page.";
        return View();
    }
}

Now run the application and see it autumnally transferred the HTTP request to https request.

SUMMARY

In this article, I try to explain the RequireHttps Attribute in ASP.NET MVC application step by step with a real-time example. I hope this article will help you with your need. I would like to have your feedback. Please post your feedback, question, or comments about this article. 

Leave a Reply

Your email address will not be published. Required fields are marked *