From f36aa018ac843a0dbc9c07f79fea188561af4c73 Mon Sep 17 00:00:00 2001 From: Stephen Walsh <868017+stphnwlsh@users.noreply.github.com> Date: Fri, 6 Nov 2026 23:04:23 +0000 Subject: [PATCH] Say that dotnet run redirects HTTP to HTTPS RUN.md said the app only redirects outside local and Development, but only HSTS is off there. Under dotnet run, http://localhost:8080 redirects to https://localhost:8081, so RUN.md now says so and how to trust the development certificate. --- docs/RUN.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/RUN.md b/docs/RUN.md index f55d1c1..b82e2e8 100644 --- a/docs/RUN.md +++ b/docs/RUN.md @@ -21,6 +21,8 @@ dotnet ef migrations add --project ./src/Infrastructure --output-dir Data dotnet run --project ./src/Presentation ``` +It listens on , and on , which redirects there. If your browser or `curl` doesn't trust the .NET development certificate yet, run `dotnet dev-certs https --trust` once. + ## Docker Compose `docker-compose.yml` starts the app, the [MCP Inspector](https://github.com/modelcontextprotocol/inspector) already pointed at it, and the [Aspire dashboard](https://learn.microsoft.com/dotnet/aspire/fundamentals/dashboard/standalone), which shows its logs, traces and metrics. The app sends everything to an [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/), and the collector forwards it to the dashboard, the same shape as a production setup. The dashboard is only a container that receives OTLP; nothing in the solution depends on Aspire. The dashboard has no login and the collector accepts OTLP from anyone on ports 4317 and 4318. That's on purpose for a developer's machine, so don't run this compose file anywhere other people can reach. @@ -70,7 +72,7 @@ Every span, metric and log carries `service.version`, so you can always tell whi ## HTTPS -Outside the `local` and `Development` environments the app sends an HSTS header and redirects HTTP to HTTPS. The container only listens on HTTP, so in production put it behind a proxy or load balancer that ends TLS, and set `ASPNETCORE_FORWARDEDHEADERS_ENABLED=true` so the app knows the original request was HTTPS. +The app redirects HTTP to HTTPS whenever it has an HTTPS port, which is why `dotnet run` sends on to . Outside the `local` and `Development` environments it also sends an HSTS header. The container only listens on HTTP, so in production put it behind a proxy or load balancer that ends TLS, and set `ASPNETCORE_FORWARDEDHEADERS_ENABLED=true` so the app knows the original request was HTTPS. ## Tests