Skip to main content

Running over HTTP instead of HTTPS

If the application must run over HTTP, modify the Lagoon:PublicUrl URL in the appsettings.json file of the Server project to replace https:// with http://.

{
  "Lagoon": {
    "PublicUrl": "http://myapp.example.com/"
  }
}

Content Security Policy​

When PublicUrl starts with https://, Lagoon adds the CSP directive upgrade-insecure-requests by default. Over HTTP, this directive is not added by default.

If you force the CSP configuration, verify that upgrade-insecure-requests is not explicitly re-enabled.

{
  "Lagoon": {
    "CSP": {
      "upgrade-insecure-requests": false
    }
  }
}

Publishing​

warning

Static files are published only in Brotli format, which is negotiated only on a secure origin. Add LagoonDefaultCompression to the Directory.Build.props file of the solution when the application must operate with HTTP.

Directory.Build.props
<Project>
  <PropertyGroup>
    <LagoonDefaultCompression>false</LagoonDefaultCompression>
  </PropertyGroup>
</Project>

Without it, the server has nothing to send to clients that don't accept Brotli: it returns 404 Not Found or an empty body, and the application won't start.

See Static file compression for details on the generated formats and verification procedure.