HSTS and UseHttpsRedirection #5902
Conversation
Rick-Anderson
changed the title
aspnetcore/security/enforcing-ssl.md
Outdated
|
|
||
| [!code-csharp[sample](enforcing-ssl/sample/Startup.cs?name=snippet1&highlight=10)] | ||
|
|
||
| `UseHsts` not recommend in development because calling `UseHsts` excludes the local loopback address. |
There was a problem hiding this comment.
"UseHsts not recommend in development because the HSTS header is highly cachable by browsers. By default, UseHsts excludes the local loopback address."
|
|
||
| * `localhost` : The IPv4 loopback address. | ||
| * `127.0.0.1` : The IPv4 loopback address. | ||
| * `[::1]` : The IPv6 loopback address. |
There was a problem hiding this comment.
Add that you also may specify other excluded hosts on the HstsOptions.
There was a problem hiding this comment.
No setter
See source
There was a problem hiding this comment.
You can still call options.ExcludedHosts.Add(...) to add onto the list.
There was a problem hiding this comment.
For some reason I can't get the version that has ExcludedHosts
I'm using <PackageReference Include="Microsoft.AspNetCore.App" Version="2.1.0-preview2-final" />
There was a problem hiding this comment.
It is part of the HstsOptions, not the HttpsRedirectionOptions.
There was a problem hiding this comment.
Can you send me the code to do that?
There was a problem hiding this comment.
Never mind, wrong place.
There was a problem hiding this comment.
services.AddHsts(options =>
{
options.Preload = true;
options.IncludeSubDomains = true;
options.MaxAge = TimeSpan.FromDays(60);
options.ExcludedHosts.Add("example.com");
options.ExcludedHosts.Add("www.example.com");
});
aspnetcore/security/enforcing-ssl.md
Outdated
| * `127.0.0.1` : The IPv4 loopback address. | ||
| * `[::1]` : The IPv6 loopback address. | ||
|
|
||
|
|
|
Looks good to me doc wise. I'll spin up the sample once I get the chance to and make sure that works. |
| ## Require HTTPS | ||
|
|
||
| ::: moniker range=">= aspnetcore-2.1" |
There was a problem hiding this comment.
Looks like you're missing the ::: moniker-end for this block.
Fixes #4568
Fixes Option to opt-out of HTTPS #5960
Review URL