[MEDIUM] HTTPS redirection is not enforced

[aatmmr]

Summary

The application does not call app.UseHttpsRedirection(), meaning HTTP requests are served without being redirected to HTTPS. This violates the security requirement to "Use HTTPS for all network communications."

Description

In src/Program.cs, the middleware pipeline does not include app.UseHttpsRedirection(). Without this middleware:

• Clients can connect over plain HTTP, exposing data in transit.
• API keys, tokens, and sensitive payloads can be intercepted via man-in-the-middle (MITM) attacks.
• Cookies (if any) transmitted without encryption are vulnerable to session hijacking.

While HTTPS may be enforced at the infrastructure level (e.g., reverse proxy, load balancer), defense-in-depth requires the application itself to enforce HTTPS redirection.

Implementation

1. Add app.UseHttpsRedirection() to the middleware pipeline in src/Program.cs, before endpoint mapping:

   app.UseHttpsRedirection();
   app.RegisterGodEndpoints();
   app.RegisterMythologiesEndpoints();

2. Ensure launchSettings.json includes an HTTPS profile for local development.
3. In production (Docker/Kubernetes), ensure the HTTPS certificate is properly configured.
4. Optionally add HSTS headers for browsers:

   if (!app.Environment.IsDevelopment())
   {
       app.UseHsts();
   }

5. Add an integration test verifying HTTP requests are redirected to HTTPS.

References

• src/Program.cs — missing UseHttpsRedirection() call
• src/Properties/launchSettings.json — launch profiles
• ASP.NET Core HTTPS enforcement: https://learn.microsoft.com/en-us/aspnet/core/security/enforcing-ssl