在 azure 上的 asp.net vnext 网站上禁用端口 80

Question

I have a feeling this should be easy, but I'm struggling to find out how to do it.

I have a website that I want to restrict to HTTPS. It is an asp.net vnext website (not mvc) that is deployed to Azure. It is serving up static files without going through the ASP.NET pipeline.

In previous versions of asp.net, you could add system.webServer rules to do a redirect. This is gone from vNext. If I was using Mvc I could use the RequireHttps attribute or I could write custom middleware to do the redirect, but this only kicks in when the asp.net pipeline is activated. My html and js (it's a SPA app) would still be served up. If I was deploying to IIS instead of Azure, I could configure it there.

So, how do I tell an azure website to only respond on port 443 without a web config file?

Answer 1

According to Azure Documentation you can add a web configuration file for applications written in any programming language supported by Azure (Node.js, PHP, Python Django, Java). You can find detailed information here.

Here is a sample:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="Force HTTPS" enabled="true">
         <match url="(.*)" ignoreCase="false" />
         <conditions>
          <add input="{HTTPS}" pattern="off" />
         </conditions>
         <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />
        </rule>
      </rules>
     </rewrite>
  </system.webServer>
</configuration>

You can achieve the redirect by adding the web.config file to your deployment. The documentation says:

when hosted on Azure App Service- Azure creates the file automatically during deployment, so you never see it. If you include one as part of your application, it will override the one that Azure automatically generates.

Answer 2

for additional level of security probably you can use nsg. Azure documentation says NSG as "you can use Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network". You can try using cli to create a nsg and put rule in there to block traffic to port 80.