Performing a request with iframe from HTTPS to HTTP is being blocked. about identityserver3.wsfederation HOT 4 CLOSED

Well, that error is coming from the browser and not from any of our code. Having said that, it's a legit error -- you should not be running the RP (or the STS) over HTTP; you should always be using HTTPS.

The only reason it's not using HTTPS for the RP is because it's not configured that way in the RP config in IdentityServer.

I can sort of understand in development not using SSL, but then you won't really be developing and testing how you will eventually deploy. Also, it's not that hard to get SSL working in VS and IIS Express.

from identityserver3.wsfederation.

@brockallen Yes its not a problem to setup an SSL while development but why should the RP strictly use HTTPS? Isn't this a limitation after all?

from identityserver3.wsfederation.

The RP needs SSL because tokens are being sent to it. Do you want those tokens sent over the plaintext shared network? I don't. Also, what about the cookie it issues to log the user in? What about the content it's showing to the user? If you're not using SSL then all of that is basically leaked onto the shared plaintext network.

from identityserver3.wsfederation.

@brockallen Thank you very much for explaination.

from identityserver3.wsfederation.