---
title: RequireSSLAttribute
summary: API reference for RequireSSLAttribute.
status: draft
owner: andmil
last_reviewed: 2026-09-15
library: SAIF.Web.API
reference_type: package
---

# RequireSSLAttribute

`RequireSSLAttribute` is a `System.Web.Http.Filters.ActionFilterAttribute` that a consuming Web API application decorates controllers or actions with to enforce HTTPS; no such decoration exists inside this library.* It runs in the action-filter pipeline before the action executes and, for non-local requests, unconditionally redirects to the HTTPS equivalent of the request URI on port 443. Local requests (as determined by an internal `IsLocal()` extension) can be exempted via the ambient application's `RequireSSLForLocal` app setting — no such application or setting exists in this repository* — making it possible to develop against plain HTTP on a developer workstation while still enforcing HTTPS everywhere else.

## Purpose
- Enforces HTTPS on any decorated action, redirecting non-HTTPS requests to the HTTPS equivalent on port 443, with a configurable exemption for local requests — see [BR-WEBAPI-012](../../business-rules.md#br-webapi-012-https-required-unless-local-exemption-applies) and [BR-WEBAPI-013](../../business-rules.md#br-webapi-013-redirect-non-https-requests-to-https).

## Context
- Namespace: `SAIF.Web.API`
- Assembly/package: `SAIF.Web.API` (NuGet)
- Base type: `System.Web.Http.Filters.ActionFilterAttribute`

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `OnActionExecuting` | `public override void OnActionExecuting(HttpActionContext actionContext)` | Checks whether the incoming request's scheme is already HTTPS; if not, evaluates `RequiresSSL` and, when required, redirects the caller to the HTTPS equivalent of the request URI on port 443 via `HttpContext.Current.Response.Redirect` before calling the base implementation — see [BR-WEBAPI-013](../../business-rules.md#br-webapi-013-redirect-non-https-requests-to-https). |

## Private members

<!-- SELF-CONTAINMENT: documented here because the analysis findings capture this member's full decision logic and business-rule linkage. -->

| Member | Signature | Purpose |
| --- | --- | --- |
| `RequiresSSL` | `private bool RequiresSSL(HttpActionContext actionContext)` | Determines whether the current request must be redirected to HTTPS: defaults to `true` (secure-by-default); for local requests, looks up the literal key `RequireSSLForLocal` in `ConfigurationManager.AppSettings.AllKeys` — if absent, forces `false` (skips HTTPS for local requests); if present, applies `bool.TryParse(value, out requireSSL)` directly against the field. Because `bool.TryParse` always assigns its `out` parameter, a value that fails to parse also results in `requireSSL` being `false` — the same outcome as when the key is absent. Non-local requests always require HTTPS regardless of this setting — see [BR-WEBAPI-012](../../business-rules.md#br-webapi-012-https-required-unless-local-exemption-applies). |

## Behavioral notes
- The redirect hard-codes port 443 via `new UriBuilder(requestUri) { Scheme = Uri.UriSchemeHttps, Port = 443 }`, so a host listening for HTTPS on a non-standard port would redirect callers to the wrong port.*
- `HttpContext.Current.Response.Redirect(url)` is called using the single-argument overload, not the `Redirect(string url, bool endResponse)` overload with `endResponse: false`, which by ASP.NET convention raises a `ThreadAbortException` to halt further processing of the current request — this is standard `Response.Redirect` behavior, not a defect specific to this attribute.*
- This attribute depends on `System.Web.HttpContext.Current`, coupling it to IIS/ASP.NET (`System.Web`) hosting; it is likely not usable in a fully self-hosted OWIN pipeline without an ambient `HttpContext`, though no self-hosted usage is exercised in this repository.*

## Constraints and usage notes
- `RequireSSLForLocal` is read from the ambient application's own `Web.config`/`App.config` — this library ships no `<appSettings>` of its own, and no such application or configuration file exists in this repository.* See [configuration.md](../../configuration.md).
- Because the local-request exemption defaults to skipping HTTPS when the key is entirely absent, a host that wants to *require* HTTPS even for local requests must explicitly set `RequireSSLForLocal` to `true`.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts.

## Sources
- `src/SAIF.Web.API/RequireSSLAttribute.cs`