Redirect from Http to Https in Owin + OAuth + ExternalLogin

10

In the Host where my application is hosted, it uses ARR to redirect all pages to Https .

The problem is that in the way that the code for asp.net mvc is configured, it means that the request is http , even though it is https .

When I see the URL that goes to Google authentication it looks like this:

&redirect_uri=http%3A%2F%mydomain.com\signing-google

So I'm trying to redirect to Google by changing "on hand" to https .

I've tried this:

 public class ChallengeResult : HttpUnauthorizedResult
{
   ...

    public override void ExecuteResult(ControllerContext context)
    {
        var properties = new AuthenticationProperties { RedirectUri = RedirectUri };
        if (UserId != null)
            properties.Dictionary[XsrfKey] = UserId;

        var owin = context.HttpContext.GetOwinContext();

        owin.Request.Scheme = "https"; //hotfix

        owin.Authentication.Challenge(properties, LoginProvider);
    }
}

and this:

 app.UseGoogleAuthentication(new GoogleOAuth2AuthenticationOptions()
            {
                ClientId = Secrets.GoogleClientId,
                ClientSecret = Secrets.GoogleClientSecret,
                Provider = new GoogleOAuth2AuthenticationProvider()
                {
                    OnApplyRedirect = async context =>
                    {
                        string redirect = context.RedirectUri;

                        redirect = redirect.Replace("redirect_uri=http", "redirect_uri=https");
                        context.Response.Redirect(redirect);
                    }
                }
            });

The two forms work and Google can redirect to my application again, however by the time I get the user data it returns null .

 public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
    {
        if (string.IsNullOrEmpty(returnUrl))
            returnUrl = "~/";

        var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
        if (loginInfo == null)
        {
            //sempre retorna null se eu mudo de http para https "na mão"
        }

I tried to see the implementation of the GetExternalLoginInfoAsync() method, but I did not find out why I always return null when I do this workaround .

    
asked by anonymous 22.10.2015 / 19:56

2 answers

1

This should not be resolved by code. This should be resolved by configuring IIS.

The best way is to insert into your Web.config the following:

<configuration>
  ...
  <system.webServer>
    ...
    <rewrite>
      <rules>
        <clear />
        <rule name="Force HTTPS" enabled="true">
          <match url="(.*)" ignoreCase="false" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="true" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
    ...
  </system.webServer>
  ...
</configuration>

In my systems, I usually put this part in the transformation file ( Web.Release.config ):

<configuration>
  ...
  <system.webServer>
    ...
    <rewrite xdt:Transform="Insert">
      <rules>
        <clear />
        <rule name="Force HTTPS" enabled="true">
          <match url="(.*)" ignoreCase="false" />
          <conditions>
            <add input="{HTTPS}" pattern="off" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="true" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>
    ...
  </system.webServer>
  ...
</configuration>
    
02.09.2016 / 18:09
1

You can add a JavaScript code to your html page in head:

<script language="JavaScript">
 function redirectHttpToHttps()
 {
    var httpURL= window.location.hostname + window.location.pathname +    window.location.search;
    var httpsURL= "https://" + httpURL;
    window.location = httpsURL;
 }
 redirectHttpToHttps();
</script>
    
24.02.2017 / 11:55