c# - Remote Require HTTPS MVC 5 -

c# - Remote Require HTTPS MVC 5 -

i have next attribute create sure remote site page opens in https mode.

public class remoterequirehttpsattribute : requirehttpsattribute { public override void onauthorization(authorizationcontext filtercontext) { if (filtercontext == null) { throw new argumentexception("filter context"); } if (filtercontext != null && filtercontext.httpcontext != null) { if (filtercontext.httpcontext.request.islocal) { return; } else { string val = configurationmanager.appsettings["requiressl"].trim(); bool requiressl = bool.parse(val); if (!requiressl) { return; } } } base.onauthorization(filtercontext); } }

local development work normal since don't want open in https mode.

dev site opens page in https mode - no issues here (single node).

where production (load balanced - 2 nodes) site setting giving me next error. please note dev , prod sites have same setings , web.config

the page isn't redirecting properly

firefox has detected server redirecting request address in way never complete.

this problem can caused disabling or refusing take cookies.

dev site url http://dev.datalab.something.org

prod site url http://datalab.something.org

and here call

[remoterequirehttps] public actionresult index(string returnurl, string error)

what missing here?

update 1: admin has confirmed ssl termination has been setup @ lad balancer evel. have looked @ iis site setup , don't see https bindings. see http binding. need setup https bindings well?

update 2: @alexeilevenkov pointed me right direction , this post had code utilized , working. moved code separate answer.

your site behind load balancer ssl termination - result incoming traffic site http irrespective user sees. causes code seek redirect https version , hence infinite loop.

options fix:

usually load balancer ssl termination forwards original ip/protocol via custom headers. x-forwarded-proto , x-forwarded-for mutual ones used purpose. may need check network admins if these headers used or additional configuration needed alternatively can turn off ssl termination, set additional load on server. one can configure load balancer talk server same protocol incoming request.

how investigate such issue:

look @ http debugger (like fiddler) see if getting 30x redirects requests in loop. if no redirects - code wrong. if see repeated redirects means site not see actual request info - protocol, path cookies missing. to go on investigation see devices between user , server (cdn, proxies, load balancer,...) - each have chance loose date or transform protocols.

c# asp.net-mvc-5