ASP.NET Core 5 Enforcing HTTPS Except on Healthcheck

So I have been looking at an issue with our login process using OpenId-Connect through Okta. The site locally works as intended, and goes through the full pipeline of OAuth calls and returns a successful login. However, when I try to do this on a deployed version of the application, it is failing. Upon closer inspection it looks like the redirect URL for the Login page is using HTTP instead of HTTPS and the AWS ELB is listening ingress of HTTPS. I did some digging and read up on how to further enforce HTTPS by adding the following code to my Configure Services Section:

services.AddHttpsRedirection(options =>
{
    options.RedirectStatusCode = StatusCodes.STatus308PermanentRedirect;
    options.HttpsPort = 443;
});

After doing this, my deployment pipeline failed because my healthcheck started failing because the healthcheck is configured for HTTP Traffic, and is now returning a Redirect. I want to avoid having to change the ECS Task definition and docker file if at all possible. Is there something that I am missing in my ConfigureServices or Configure method? I have already used app.UseHsts() and app.UseHttpsRedirection in Configure.

Source: Docker Questions

LEAVE A COMMENT