Azure Ad authentication reply url contains http instead of https with .netcore middleware - how to enforce https?

Question

Notice the http instead of https. When I replace http with https the I am redirected and successfully receive the bearer token. How do I enforce the url generated by the middleware to contain https?

Middleware:

   services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
        .AddAzureAD(options => Configuration.Bind("AzureAd", options));

Request created upon redirection:

https://login.microsoftonline.com/6957e{...}825/oauth2/authorize?
    client_id=747{...}9810&redirect_uri=http%3A%2F%2F {... continued url ...}

Answer 1

For people using docker and deploy to Azure App Services: add the following in your DockerFile: ENV ASPNETCORE_FORWARDEDHEADERS_ENABLED=true

It turned out that AAD redirect uri was set to http instead of https

Answer 2

Based on the Microsoft documentation you should use UseHttpsRedirection to achieve this:

• The HTTPS Redirection Middleware (UseHttpsRedirection) to redirect all HTTP requests to HTTPS.

ASP.NET Core Enforce HTTPS

The .UseHttpsRedirection() will issue HTTP response codes redirecting from http to https.