Information
Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.
Rationale:
Enabling HTTPS-only traffic will redirect all non-secure HTTP request to HTTPS ports. HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. So it is important to support HTTPS for the security benefits.
Impact:
When it is enabled, every incoming HTTP requests are redirected to the HTTPS port. It means an extra level of security will be added to the HTTP requests made to the app.
Solution
From Azure Console
Login to Azure Portal using https://portal.azure.com
Go to App Services
Click on each App
Under Setting section, Click on SSL settings
Set HTTPS Only to On under Protocol Settings section
Using Azure Command Line Interface
To set HTTPS-only traffic value for an existing app, run the following command:
az webapp update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --set httpsOnly=true
Default Value:
By default, HTTPS-only feature will be disabled when a new app is created using the command-line tool or Azure Portal console.