RequireHttps - should it be redirect 302 by default? #4561
Description
RequireHttps uses a 301 permanent redirect.
It used to be 302 in MVC 5 AFAIK so this adds to the confusion.
All the major browsers cache 301 indefinitely so if you use RequireHttps in your code you can never remove it.
Otherwise you will have code that may not match the behaviour of your site depending on the state of the users browser cache. This can cause some confusion without an in depth knowledge of browser behaviour and 301 vs. 302.
I realise I could override the attribute to say something like RequireHttpsNotPermanent but given the one way street that is 301 I propose making RequireHttps 302 (like it used to be) by default. Make 301 an opt in so you are aware of the consequences.
Perhaps with an overridden RequireHttpsPermanent or RequireHttps("Permanent") attribute for 301.
Discussed at length here
aspnet/Security#798