Question

Is there a way to require SSL for WebApi? An attribute?

I don’t see an applicable attribute under System.Web.Http, something like the RequireHttps attribute we have for MVC. I’m just trying to avoid rolling my own attribute/ message handler if there is a built in solution.

Answer 1

You can use the RequireHttpsHandler from WebAPIContrib project. Basically, all it does is to check the incoming request URI scheme:

if (request.RequestUri.Scheme != Uri.UriSchemeHttps)
{
  // Forbidden (or do a redirect)...
}

Alternately, Carlos Figueira has another implementation on his MSDN blog.