title: AWS Elastic Beanstalk load balancer is redirecting to HTTPS - does my app still need UseHttpsRedirection() and UseHsts()?
body: <p>First, let me say that this is the first time I have written an ASP.NET Core 3.1 web app and first time learning AWS with Elastic Beanstalk.  So if it seems like I'm confused... it's because I am.  ;-)</p>
  <p>I have two AWS environments - one is Staging and one is Production.  The Staging environment has no SSL certificate and no load balancer.  It only listens on port 80.</p>
  <p>Production has a load balancer set up with my SSL certificate, and is set up to redirect all port 80 traffic to port 443.</p>
  <p>Port 80 = Redirect to https://#{host}:443/#{path}?#{query}
  Status code:HTTP_301</p>
  <p>Port 443 = Forward to my-target-group: 1 (100%)
  Group-level stickiness: Off</p>
  <p>When I generated the new web app in VS 2019, I opted in on HTTPS/HSTS by checking &quot;Configure for HTTPS&quot;.  So it has this in Startup.cs:</p>
  <pre><code>    if (env.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
      }
      else
      {
          app.UseExceptionHandler(&quot;/Home/Error&quot;);
          // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
          app.UseHsts();
      }
  
      app.UseHttpsRedirection();
  </code></pre>
  <p>I am getting this error in my Windows event log in Staging and Production: <em>“Failed to determine the https port for redirect”</em></p>
  <p>I tried the suggestion from <a href="https://docs.microsoft.com/en-us/aspnet/core/security/enforcing-ssl" rel="nofollow noreferrer">Enforce HTTPS in ASP.NET Core</a></p>
  <pre><code>    services.AddHttpsRedirection(options =&gt;
      {
          options.HttpsPort = 443;
      });
  </code></pre>
  <p>But that messed up the Staging environment because there's nothing listening on port 443.</p>
  <p>Since Staging is only using HTTP, and Production is redirecting to HTTPS at the load balancer, should I just remove the UseHsts() and UseHttpsRedirection() altogether from my Startup?  Will that pose any security problems - I do want traffic encrypted over the internet but I don't think it's necessary between the load balancer and the EC2 instance, correct?</p>
  <p>Or do I need Forwarded headers, as suggested at <a href="https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer" rel="nofollow noreferrer">Configure ASP.NET Core to work with proxy servers and load balancers</a>?</p>