Allow to proxy from HTTPS to HTTP

[dluc]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

When using .WithHttpEndpoint() Aspire automatically proxies, from an HTTP endpoint to target HTTP endpoint.

When using .WithHttpsEndpoint() Aspire automatically proxies from an HTTPS endpoint to target HTTP endpoint. In this scenario, it leverages .NET dev cert, which is trusted, a nice to have when working with web apps locally, so the user doesn't get security alerts.

However, there is no way to have an HTTPS endpoing proxying to a target HTTP endpoint. For instance, when serving a web site and working with OAuth, one might need to use HTTPS.

On Azure, the platform takes care of proxying from HTTPS to HTTP.
Aspire doesn't offer the same, so one has to implement SSL locally with custom certs, to be created and configured, leading to more work. Another approach is spinning up, only locally, a reverse proxy app/container like stunnel, grok, and similar, to do that, something like this:

var httpApp = builder
                 .AddProject<MyApp>()
                 .WithHttpEndpoint();

var httpsApp = builder.AddProject<Proxy>()
                 .WithEnvironment("TARGET_ENDPOINT", httpApp.GetEndpoint("http"))
                 .WithHttpsEndpoint();

Describe the solution you'd like

Allow to map from HTTPS to HTTP, something like

var httpsApp = builder
                 .AddProject<MyApp>()
                 .WithHttpsEndpoint(httpsTarget = false); // the internal endpoint will be http://...

This way, the HTTPS endpoint will leverage .NET dev cert, and the internal endpoint is a simple HTTP endpoint that doesn't require and SSL configuration.

[DamianEdwards]

The proxying that Aspire does during the local dev inner loop today is TCP-level, not HTTP level, so it can't easily proxy from HTTPS to HTTP. There are other issues covering HTTP ingress and better support for HTTPS using the dev cert though that would likely improve your scenario:

• Provide a non-localhost domain for Aspire project & service endpoints #5508
• Support for YARP-based reverse proxy to use as ingress #836
• Allow specifying an address hostname for project/service binding #4319
• Aspire Assistance with HTTPS #5453
• Add support for configuring non-project resources to trust and/or use the ASP.NET Core HTTPS development certificate #6890