TheCodeBuzz

Updated October 2026 for .NET 10 (LTS) and ASP.NET Core 10.

ASP.NET Core logs this warning when app.UseHttpsRedirection() wants to send a visitor from HTTP to HTTPS but cannot work out which HTTPS port to use. The request is then not redirected. It is very common in Docker, Kubernetes and behind load balancers, where your app only listens on HTTP and something in front of it handles HTTPS.

The warning

warn: Microsoft.AspNetCore.HttpsPolicy.HttpsRedirectionMiddleware[3]
      Failed to determine the https port for redirect.

How the middleware finds the HTTPS port

It looks in this order and uses the first port it finds:

1. The HttpsPort option set in code with AddHttpsRedirection
2. The https_port setting, or the ASPNETCORE_HTTPS_PORT environment variable
3. The server’s own addresses, if Kestrel listens on exactly one HTTPS address

If none of these gives a port, you get the warning. In containers this is the default situation: since .NET 8, the official ASP.NET Core images listen on plain HTTP port 8080, with no HTTPS address at all.

First, decide who handles HTTPS

• A proxy or platform handles HTTPS (Nginx, IIS, Azure App Service, a Kubernetes ingress, a cloud load balancer): use Fix 1. Usually the proxy should also do the HTTP-to-HTTPS redirect.
• Kestrel handles HTTPS itself (your app has a certificate): use Fix 2.

Fix 1: Behind a proxy, forward the original scheme

The proxy receives HTTPS and passes the request on as HTTP, adding an X-Forwarded-Proto: https header. Tell ASP.NET Core to trust that header, so it knows the original request was already secure:

using System.Net;
using Microsoft.AspNetCore.HttpOverrides;

var builder = WebApplication.CreateBuilder(args);

builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;

    // Trust only your proxy's network (example range)
    options.KnownIPNetworks.Add(IPNetwork.Parse("10.0.0.0/8"));
});

var app = builder.Build();

app.UseForwardedHeaders(); // must run before other middleware

if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}

app.MapControllers();
app.Run();

Notes:

• In .NET 10, use KnownIPNetworks. The older KnownNetworks property is obsolete.
• Only trust proxies you control. Accepting forwarded headers from anyone lets clients fake their IP address and scheme.
• If the proxy already redirects HTTP to HTTPS, remove app.UseHttpsRedirection() from your app. The warning goes away and you avoid redirect loops.

Fix 2: Tell the app which HTTPS port to use

If your app redirects to HTTPS itself, give it the public HTTPS port. Pick one of these.

In code:

builder.Services.AddHttpsRedirection(options =>
{
    options.HttpsPort = 443;
    options.RedirectStatusCode = StatusCodes.Status308PermanentRedirect;
});

var app = builder.Build();
app.UseHttpsRedirection();

In appsettings.json:

{
  "https_port": 443,
  "Logging": {
    "LogLevel": { "Default": "Information" }
  }
}

As an environment variable (Docker, Kubernetes, App Service settings):

ASPNETCORE_HTTPS_PORT=443

Use the port that visitors see in their browser, normally 443, not an internal container port.

Local development

Running locally with only an HTTP profile also triggers the warning. Start the https launch profile (dotnet run --launch-profile https) and trust the development certificate once:

dotnet dev-certs https --trust

FAQ

Is this warning dangerous?

The app still works, but HTTP requests are not upgraded to HTTPS by your app. That is fine if a proxy does the redirect, and a security gap if nothing does.

Do I still need HSTS?

Yes, for public sites served over HTTPS. HSTS tells browsers to use HTTPS on future visits. See HTTP Strict Transport Security (HSTS) headers.

Related

• Bypass or trust SSL certificates in .NET
• Copy files from host to Docker
• Return HTTP status codes in ASP.NET Core
• Free tool: C# Class Converter

Sources: Microsoft Learn: Enforce HTTPS in ASP.NET Core · Microsoft Learn: Proxy servers and load balancers · Microsoft Learn: Default container port 8080