How to enforce only Https only request to identityserver4 - identityserver4

Question

I have IdentityServer4 configured and deployed on Azure App Service, I have used the custom SSL certificate to sign tokens. Everything is working fine, however I want to enforce identity server to receive request from https clients only and throw error otherwise.
I read this part of the documentation on identityserver4(http://docs.identityserver.io/en/latest/topics/crypto.html?highlight=HTTPS) where they say:
"We don’t enforce the use of HTTPS, but for production it is mandatory for every interaction with IdentityServer."
Just was wondering is it possible to enforce only https client request.
Any help or pointers is greatly appreciated

Answer 1

That'd typically something you'd configure at web server/traffic manager level rather then at application level (although you can ofcourse have application logic to enforce it too).
This should be of use: https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-ssl
Also check out the HSTS header: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet
And also consider the use of a robust Content Security Policy that blocks or upgrades insecure resource requests. e.g. Content-Security-Policy: upgrade-insecure-requests; block-all-mixed-content; Check out https://report-uri.com/home/generate and https://scotthelme.co.uk/csp-cheat-sheet/

Answer 2

You can enforce the HSTS header and HTTPS redirection with the following calls in the Configure method in the Startup class.
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
//...
app.UseHsts();
app.UseHttpsRedirection();
//...
}
For all the configuration options and best practices refer to this link:
https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl