OWIN and Azure AD HTTPS to HTTP Redirect Loop -

i new owin :). trying have page open public area allow anonymous on http, , restricted section require authentication. i'd not force entire site https general users.

the issue have receive following loop:

1. http://example.com/authenticatedpage -> 302 redirect ad login
2. login ad page http 200. triggers open of azure ad link site.
3. link site identifies owin redirect , 302 redirect http://example.com/authenticatedpage
4. go 1.

i have tried 3 ways of intercepting redirect in owin nothing seems work.

if begin session browsing https://example.com/ click on link authenticatedpage, login works expect. i.e.

1. load https://example.com/authenticatedpage -> 302 redirect ad
2. login ad -> loads https://example.com/
3. 302 redirect https://example.com/authenticatedpage

is there anyway fix without marking whole site requiring ssl?

the problem referrer set oidc middleware in application. happens this:

1. enter application on http://foo.bar , redirect identity provider
2. the idp/ad redirects https://foo.bar configured return uri
3. cookie set oidc middleware secure flag https only
4. middleware redirects referrer url http
5. cookie not set on http, step 1.

there multiple solutions such enforcing ssl only, overloading authorize attribute , setting cookiesecure flag cookiesecureoption.never (don't this).

the option prefer fix referrer in middleware such:

app.useopenidconnectauthentication(new openidconnectauthenticationoptions {     authority = ...     clientid = ...     redirecturi = "https://foo.bar"     responsetype = "id_token",     scope = "openid profile",           signinasauthenticationtype = "cookies",      // deal returning tokens     notifications = new openidconnectauthenticationnotifications     {         authorizationcodereceived = async n =>         {             // enforce reference/redirect https             var builder = new uribuilder(n.authenticationticket.properties.redirecturi);             builder.scheme = "https";             builder.port = 443;             n.authenticationticket.properties.redirecturi = builder.tostring();         }     } }); 

what rewrite http on referrer url https. way if user enters app on http, he'll automatically redirected https version after using it.