AspNetCore.Docs/aspnetcore/security/enforcing-ssl.md

title	author	description	manager	ms.author	ms.date	ms.prod	ms.technology	ms.topic	uid
Enforcing SSL in an ASP.NET Core app	rick-anderson	Shows how to require SSL in a ASP.NET Core web app	wpickett	riande	07/19/2017	asp.net-core	aspnet	article	security/enforcing-ssl

Enforcing SSL in an ASP.NET Core app

By Rick Anderson

This document shows how to:

• Require SSL for all requests (HTTPS requests only).
• Redirect all HTTP requests to HTTPS.

Require SSL

The RequireHttpsAttribute is used to require SSL. You can decorate controllers or methods with this attribute or you can apply it globally as shown below:

Add the following code to ConfigureServices in Startup:

[!code-csharpMain]

The highlighted code above requires all requests use HTTPS, therefore HTTP requests are ignored. The following highlighted code redirects all HTTP requests to HTTPS:

[!code-csharpMain]

See URL Rewriting Middleware for more information.

Requiring HTTPS globally (options.Filters.Add(new RequireHttpsAttribute());) is a security best practice. Applying the [RequireHttps] attribute to all controller isn't considered as secure as requiring HTTPS globally. You can't guarantee new controllers added to your app will remember to apply the [RequireHttps] attribute.