self hosted WEB API over HTTPS. Reject all HTTP calls

Question

I have a self hosted WEB API project that needs to run over HTTPS only.

I found several articles how to do that (get SSL certificate, bind the certificate to the IP/Port using 'netsh' command, change base address to HTTPS://..., etc).

All looks good so far and I can call the service over HTTPS.

But I also need to explicitly reject all HTTP calls. When I try to call the service using HTTP I am getting '504 Timeout" error. And it takes a while to get a response from the service, it's possible to get Denial of Service.

I tried to apply a custom attribute that will check if the request comes over HTTPS but that code is never reached.

What do i need to do in order to reject HTTP calls. Again it's a self host WEB API project.

I am not hosting WEB API in IIS. It's a self hosted WEB API. Here's the code how I initialize it:

public class HttpsSelfHostConfiguration : HttpSelfHostConfiguration
{
   public HttpsSelfHostConfiguration(string baseAddress) : base(baseAddress) { }
   public HttpsSelfHostConfiguration(Uri baseAddress) : base(baseAddress) { }

  protected override BindingParameterCollection OnConfigureBinding(HttpBinding httpBinding)
  {
      if (BaseAddress.ToString().ToLower().Contains("https://"))
      {
          httpBinding.Security.Mode = HttpBindingSecurityMode.Transport;
      }
      return base.OnConfigureBinding(httpBinding);
  }
}

var url = "https://localhost:7080/";

var config = new HttpsSelfHostConfiguration(url);

config.Routes.MapHttpRoute("WebAPIRoute2", "api/{controller}/{action}/{id}",
      new { controller = "Submissions", id = RouteParameter.Optional });


var server = new HttpSelfHostServer(config);
server.OpenAsync().Wait();

I also used the following commands to bind a SSL certificate to port 7080:

netsh http add urlacl url=https://+:7080/ user=Everyone

netsh http add sslcert ipport=0.0.0.0:7080 certhash=Thumbprint appid={xxxx}

You need to tell us more about your setup. Webserver in front of your code ? Which webserver ? Does it have a listener on port 80 or not ? Which language do you use for your API ? ... — Marged, Oct 08 '15 at 10:31
I'm struggling with same problem. Have you found a solution for this? — AFgone, Nov 24 '15 at 09:25
No, i have not. All I am doing is I am explicitly binding the port to HTTPS protocol. All HTTP requests are timing out. I have no other solution :( — Alex Pavlov, Nov 25 '15 at 13:37
It's been a while now. I'm also looking for a solution for this. Have you found anything until now, about 3 years later?? — Jmie, Dec 12 '18 at 08:51

score 0 · Answer 1 · edited May 23 '17 at 12:15

I am guessing you need something like this

Best way in asp.net to force https for an entire site?

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="HTTP to HTTPS redirect" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                        redirectType="Permanent" />
                </rule>
            </rules>
            <outboundRules>
                <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
                    <match serverVariable="RESPONSE_Strict_Transport_Security"
                        pattern=".*" />
                    <conditions>
                        <add input="{HTTPS}" pattern="on" ignoreCase="true" />
                    </conditions>
                    <action type="Rewrite" value="max-age=31536000" />
                </rule>
            </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>


protected void Application_BeginRequest(Object sender, EventArgs e)
{
   if (HttpContext.Current.Request.IsSecureConnection.Equals(false) && HttpContext.Current.Request.IsLocal.Equals(false))
   {
    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
+   HttpContext.Current.Request.RawUrl);
   }
}

self hosted WEB API over HTTPS. Reject all HTTP calls

1 Answers1