Warm tip: This article is reproduced from serverfault.com, please click

Does asp.net core kestrel need to run on https in production?

发布于 2020-12-01 21:58:24

I am potentially planning to run asp.net core on linux behind an apache reverse proxy.

when running the asp.net core does it need to be running on https?

I can set apache https directive as follow - and when i access this from the browser it is working fine.

ProxyPass / http://127.0.0.1:5000/
ProxyPassReverse / http://127.0.0.1:5000/
ServerName app.domain.com
ServerAlias *.app.domain.com
ErrorLog ${APACHE_LOG_DIR}helloapp-error.log
CustomLog ${APACHE_LOG_DIR}helloapp-access.log common

Are there any issues with this?

Questioner
Steve
Viewed
0
Brando Zhang 2020-12-02 10:08:17

In my opinion, if you has enabled the https on the apache and just use http redirect between the apache and the kestrel server, you could use http. Like this:

Brower --->https ---> Apache --> http ---> kestrel.

This will not causing the security issue. HTTPS helps prevent intruders from tampering with the communications between your websites and your users' browsers. Since if someone hack your server to capture the http request, he could also get your server's all information.