RequireSSLAttribute

RequireSSLAttribute is a System.Web.Http.Filters.ActionFilterAttribute that a consuming Web API application decorates controllers or actions with to enforce HTTPS; no such decoration exists inside this library.* It runs in the action-filter pipeline before the action executes and, for non-local requests, unconditionally redirects to the HTTPS equivalent of the request URI on port 443. Local requests (as determined by an internal IsLocal() extension) can be exempted via the ambient application's RequireSSLForLocal app setting — no such application or setting exists in this repository* — making it possible to develop against plain HTTP on a developer workstation while still enforcing HTTPS everywhere else.

Purpose

• Enforces HTTPS on any decorated action, redirecting non-HTTPS requests to the HTTPS equivalent on port 443, with a configurable exemption for local requests — see BR-WEBAPI-012 and BR-WEBAPI-013.

Context

• Namespace: SAIF.Web.API
• Assembly/package: SAIF.Web.API (NuGet)
• Base type: System.Web.Http.Filters.ActionFilterAttribute

Public members

Member	Signature	Purpose
OnActionExecuting	public override void OnActionExecuting(HttpActionContext actionContext)	Checks whether the incoming request's scheme is already HTTPS; if not, evaluates RequiresSSL and, when required, redirects the caller to the HTTPS equivalent of the request URI on port 443 via HttpContext.Current.Response.Redirect before calling the base implementation — see BR-WEBAPI-013.

Private members

Member	Signature	Purpose
RequiresSSL	private bool RequiresSSL(HttpActionContext actionContext)	Determines whether the current request must be redirected to HTTPS: defaults to true (secure-by-default); for local requests, looks up the literal key RequireSSLForLocal in ConfigurationManager.AppSettings.AllKeys — if absent, forces false (skips HTTPS for local requests); if present, applies bool.TryParse(value, out requireSSL) directly against the field. Because bool.TryParse always assigns its out parameter, a value that fails to parse also results in requireSSL being false — the same outcome as when the key is absent. Non-local requests always require HTTPS regardless of this setting — see BR-WEBAPI-012.

Behavioral notes

• The redirect hard-codes port 443 via new UriBuilder(requestUri) { Scheme = Uri.UriSchemeHttps, Port = 443 }, so a host listening for HTTPS on a non-standard port would redirect callers to the wrong port.*
• HttpContext.Current.Response.Redirect(url) is called using the single-argument overload, not the Redirect(string url, bool endResponse) overload with endResponse: false, which by ASP.NET convention raises a ThreadAbortException to halt further processing of the current request — this is standard Response.Redirect behavior, not a defect specific to this attribute.*
• This attribute depends on System.Web.HttpContext.Current, coupling it to IIS/ASP.NET (System.Web) hosting; it is likely not usable in a fully self-hosted OWIN pipeline without an ambient HttpContext, though no self-hosted usage is exercised in this repository.*

Constraints and usage notes

• RequireSSLForLocal is read from the ambient application's own Web.config/App.config — this library ships no <appSettings> of its own, and no such application or configuration file exists in this repository.* See configuration.md.
• Because the local-request exemption defaults to skipping HTTPS when the key is entirely absent, a host that wants to require HTTPS even for local requests must explicitly set RequireSSLForLocal to true.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

• src/SAIF.Web.API/RequireSSLAttribute.cs