Add no-https option for all templates (#413)

Addresses #322

src/Microsoft.DotNet.Web.ProjectTemplates/StarterWeb-CSharp.csproj.in

@@ -30,7 +30,7 @@
     <PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" Version="${MicrosoftAspNetCoreAuthenticationCookiesPackageVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
     <PackageReference Include="Microsoft.AspNetCore.CookiePolicy" Version="${MicrosoftAspNetCoreCookiePolicyPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="${MicrosoftAspNetCoreDiagnosticsEntityFrameworkCorePackageVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
-    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" Condition="'$(RequiresHttps)' == 'True'"/>
     <PackageReference Include="Microsoft.AspNetCore.Identity.UI" Version="${MicrosoftAspNetCoreIdentityEntityFrameworkCorePackageVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="${MicrosoftAspNetCoreIdentityEntityFrameworkCorePackageVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="${MicrosoftAspNetCoreMvcPackageVersion}" />

src/Microsoft.DotNet.Web.ProjectTemplates/StarterWeb-FSharp.fsproj.in

@@ -22,7 +22,7 @@
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="${MicrosoftAspNetCoreMvcPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Razor.ViewCompilation" Version="${MicrosoftAspNetCoreMvcRazorViewCompilationPackageVersion}" PrivateAssets="All" />
     <PackageReference Include="Microsoft.AspNetCore.StaticFiles" Version="${MicrosoftAspNetCoreStaticFilesPackageVersion}" />
-    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" Condition="'$(NoHttps)' != 'True'"/>
   </ItemGroup>
 
 </Project>

src/Microsoft.DotNet.Web.ProjectTemplates/WebApi-CSharp.csproj.in

@@ -21,7 +21,7 @@
     <PackageReference Include="Microsoft.AspNetCore" Version="${MicrosoftAspNetCorePackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.AzureAD.UI" Version="${MicrosoftAspNetCoreAuthenticationAzureADUIPackageVersion}" Condition="'$(OrganizationalAuth)' == 'True'" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.AzureADB2C.UI" Version="${MicrosoftAspNetCoreAuthenticationAzureADB2CUIPackageVersion}" Condition="'$(IndividualB2CAuth)' == 'True'" />
-    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" Condition="'$(RequiresHttps)' == 'True'" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="${MicrosoftAspNetCoreMvcPackageVersion}" />
   </ItemGroup>
 

src/Microsoft.DotNet.Web.ProjectTemplates/WebApi-FSharp.fsproj.in

@@ -17,7 +17,7 @@
   <ItemGroup Condition="'$(TargetFrameworkOverride)' != ''">
     <PackageReference Include="Microsoft.AspNetCore" Version="${MicrosoftAspNetCorePackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="${MicrosoftAspNetCoreMvcPackageVersion}" />
-    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" Condition="'$(NoHttps)' != 'True'" />
   </ItemGroup>
 
 </Project>

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-CSharp/.template.config/dotnetcli.host.json

@@ -22,6 +22,10 @@
     "ExcludeLaunchSettings": {
       "longName": "exclude-launch-settings",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   },
   "usageExamples": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-CSharp/.template.config/template.json

@@ -68,7 +68,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -120,6 +120,12 @@
       "datatype": "bool",
       "description": "If specified, skips the automatic restore of the project on create.",
       "defaultValue": "false"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     }
   },
   "primaryOutputs": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-CSharp/.template.config/vs-2017.3.host.json

@@ -27,5 +27,6 @@
     }
   ],
   "excludeLaunchSettings": false,
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-CSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(NoHttps)
+      "applicationUrl": "http://localhost:5000",
+      //#else
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-FSharp/.template.config/dotnetcli.host.json

@@ -22,6 +22,10 @@
     "ExcludeLaunchSettings": {
       "longName": "exclude-launch-settings",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   },
   "usageExamples": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-FSharp/.template.config/template.json

@@ -64,7 +64,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -116,6 +116,12 @@
       "datatype": "bool",
       "description": "If specified, skips the automatic restore of the project on create.",
       "defaultValue": "false"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     }
   },
   "primaryOutputs": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-FSharp/.template.config/vs-2017.3.host.json

@@ -25,5 +25,6 @@
       "useHttps": true
     }
   ],
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.ProjectTemplates/content/EmptyWeb-FSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(NoHttps)
+      "applicationUrl": "http://localhost:5000",
+      //#else
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.ProjectTemplates/content/RazorPagesWeb-CSharp/.template.config/template.json

@@ -307,6 +307,12 @@
       "defaultValue": "false",
       "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
+    },
     "UseLocalDB": {
       "type": "parameter",
       "datatype": "bool",

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-CSharp/.template.config/dotnetcli.host.json

@@ -72,6 +72,10 @@
     "UseBrowserLink": {
       "longName": "use-browserlink",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   },
   "usageExamples": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-CSharp/.template.config/template.json

@@ -239,7 +239,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -292,7 +292,13 @@
     },
     "RequiresHttps": {
       "type": "computed",
-      "value": "(OrganizationalAuth || IndividualAuth)"
+      "value": "(OrganizationalAuth || IndividualAuth || !NoHttps)"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     },
     "UseLocalDB": {
       "type": "parameter",

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-CSharp/.template.config/vs-2017.3.host.json

@@ -22,7 +22,8 @@
   "supportedAuthentications": [
     {
       "auth": "None",
-      "authenticationType": "NoAuth"
+      "authenticationType": "NoAuth",
+      "allowUnsecured": true
     },
     {
       "auth": "Individual",
@@ -61,5 +62,6 @@
   ],
   "excludeLaunchSettings": false,
   "azureReplyUrlPortName": "HttpsPort",
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-CSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(RequiresHttps)
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#else
+      "applicationUrl": "http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-CSharp/Startup.cs

@@ -21,7 +21,9 @@ using Microsoft.AspNetCore.Identity;
 #endif
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Http;
+#if (RequiresHttps)
 using Microsoft.AspNetCore.HttpsPolicy;
+#endif
 using Microsoft.AspNetCore.Mvc;
 #if (OrganizationalAuth)
 using Microsoft.AspNetCore.Mvc.Authorization;
@@ -143,10 +145,15 @@ namespace Company.WebApplication1
             else
             {
                 app.UseExceptionHandler("/Home/Error");
+#if (RequiresHttps)
                 app.UseHsts();
             }
 
             app.UseHttpsRedirection();
+#else
+            }
+
+#endif
             app.UseStaticFiles();
             app.UseCookiePolicy();
 

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-FSharp/.template.config/dotnetcli.host.json

@@ -22,6 +22,10 @@
     "skipRestore": {
       "longName": "no-restore",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   },
   "usageExamples": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-FSharp/.template.config/template.json

@@ -74,7 +74,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -126,6 +126,12 @@
       "datatype": "bool",
       "description": "If specified, skips the automatic restore of the project on create.",
       "defaultValue": "false"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     }
   },
   "primaryOutputs": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-FSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(NoHttps)
+      "applicationUrl": "http://localhost:5000",
+      //#else
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.ProjectTemplates/content/StarterWeb-FSharp/Startup.fs

@@ -6,7 +6,9 @@ open System.Linq
 open System.Threading.Tasks
 open Microsoft.AspNetCore.Builder
 open Microsoft.AspNetCore.Hosting
-open Microsoft.AspNetCore.HttpsPolicy
+#if (!NoHttps)
+open Microsoft.AspNetCore.HttpsPolicy;
+#endif
 open Microsoft.AspNetCore.Mvc
 open Microsoft.Extensions.Configuration
 open Microsoft.Extensions.DependencyInjection
@@ -28,9 +30,13 @@ type Startup private () =
             app.UseDeveloperExceptionPage() |> ignore
         else
             app.UseExceptionHandler("/Home/Error") |> ignore
+#if (!NoHttps)
             app.UseHsts() |> ignore
 
         app.UseHttpsRedirection() |> ignore
+#else
+
+#endif
         app.UseStaticFiles() |> ignore
 
         app.UseMvc(fun routes ->

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-CSharp/.template.config/dotnetcli.host.json

@@ -56,6 +56,10 @@
     },
     "UserSecretsId": {
       "isHidden": true
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   },
   "usageExamples": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-CSharp/.template.config/template.json

@@ -151,7 +151,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -196,7 +196,13 @@
     },
     "RequiresHttps": {
       "type": "computed",
-      "value": "(OrganizationalAuth || IndividualAuth)"
+      "value": "(OrganizationalAuth || IndividualAuth || !NoHttps)"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     },
     "UseLocalDB": {
       "type": "parameter",

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-CSharp/.template.config/vs-2017.3.host.json

@@ -21,7 +21,8 @@
   "supportedAuthentications": [
     {
       "auth": "None",
-      "authenticationType": "NoAuth"
+      "authenticationType": "NoAuth",
+      "allowUnsecured": true
     },
     {
       "auth": "Individual",
@@ -50,5 +51,6 @@
   ],
   "excludeLaunchSettings": false,
   "azureReplyUrlPortName": "HttpsPort",
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-CSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(RequiresHttps)
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#else
+      "applicationUrl": "http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-CSharp/Startup.cs

@@ -4,7 +4,9 @@ using System.Linq;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
+#if (RequiresHttps)
 using Microsoft.AspNetCore.HttpsPolicy;
+#endif
 using Microsoft.AspNetCore.Mvc;
 #if (OrganizationalAuth || IndividualB2CAuth)
 using Microsoft.AspNetCore.Authentication;
@@ -51,11 +53,16 @@ namespace Company.WebApplication1
             {
                 app.UseDeveloperExceptionPage();
             }
+#if (RequiresHttps)
             else
             {
                 app.UseHsts();
             }
 
+            app.UseHttpsRedirection();
+#else
+
+#endif
             app.UseHttpsRedirection();
 #if (OrganizationalAuth || IndividualAuth)
             app.UseAuthentication();

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-FSharp/.template.config/dotnetcli.host.json

@@ -22,6 +22,10 @@
     "skipRestore": {
       "longName": "no-restore",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   },
   "usageExamples": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-FSharp/.template.config/template.json

@@ -64,7 +64,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -116,6 +116,12 @@
       "datatype": "bool",
       "description": "If specified, skips the automatic restore of the project on create.",
       "defaultValue": "false"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     }
   },
   "primaryOutputs": [

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-FSharp/.template.config/vs-2017.3.host.json

@@ -27,5 +27,6 @@
     }
   ],
   "azureReplyUrlPortName": "HttpsPort",
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-FSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(NoHttps)
+      "applicationUrl": "http://localhost:5000",
+      //#else
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.ProjectTemplates/content/WebApi-FSharp/Startup.fs

@@ -6,7 +6,9 @@ open System.Linq
 open System.Threading.Tasks
 open Microsoft.AspNetCore.Builder
 open Microsoft.AspNetCore.Hosting
-open Microsoft.AspNetCore.HttpsPolicy
+#if (!NoHttps)
+open Microsoft.AspNetCore.HttpsPolicy;
+#endif
 open Microsoft.AspNetCore.Mvc
 open Microsoft.Extensions.Configuration
 open Microsoft.Extensions.DependencyInjection
@@ -25,10 +27,14 @@ type Startup private () =
     member this.Configure(app: IApplicationBuilder, env: IHostingEnvironment) =
         if (env.IsDevelopment()) then
             app.UseDeveloperExceptionPage() |> ignore
+#if (!NoHttps)
         else
             app.UseHsts() |> ignore
 
         app.UseHttpsRedirection() |> ignore
+#else
+
+#endif
         app.UseMvc() |> ignore
 
     member val Configuration : IConfiguration = null with get, set

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/Angular-CSharp.csproj.in

@@ -19,7 +19,7 @@
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFrameworkOverride)' != ''">
     <PackageReference Include="Microsoft.AspNetCore" Version="${MicrosoftAspNetCorePackageVersion}" />
-    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" Condition="'$(NoHttps)' != 'True'"/>
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="${MicrosoftAspNetCoreMvcPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.SpaServices" Version="${MicrosoftAspNetCoreSpaServicesPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.SpaServices.Extensions" Version="${MicrosoftAspNetCoreSpaServicesExtensionsPackageVersion}" />

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/React-CSharp.csproj.in

@@ -16,7 +16,7 @@
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFrameworkOverride)' != ''">
     <PackageReference Include="Microsoft.AspNetCore" Version="${MicrosoftAspNetCorePackageVersion}" />
-    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" Condition="'$(NoHttps)' != 'True'"/>
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="${MicrosoftAspNetCoreMvcPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.SpaServices" Version="${MicrosoftAspNetCoreSpaServicesPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.SpaServices.Extensions" Version="${MicrosoftAspNetCoreSpaServicesExtensionsPackageVersion}" />

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/ReactRedux-CSharp.csproj.in

@@ -16,7 +16,7 @@
   </ItemGroup>
   <ItemGroup Condition="'$(TargetFrameworkOverride)' != ''">
     <PackageReference Include="Microsoft.AspNetCore" Version="${MicrosoftAspNetCorePackageVersion}" />
-    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" />
+    <PackageReference Include="Microsoft.AspNetCore.HttpsPolicy" Version="${MicrosoftAspNetCoreHttpsPolicyPackageVersion}" Condition="'$(NoHttps)' != 'True'"/>
     <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="${MicrosoftAspNetCoreMvcPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.SpaServices" Version="${MicrosoftAspNetCoreSpaServicesPackageVersion}" />
     <PackageReference Include="Microsoft.AspNetCore.SpaServices.Extensions" Version="${MicrosoftAspNetCoreSpaServicesExtensionsPackageVersion}" />

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/Angular-CSharp/.template.config/dotnetcli.host.json

@@ -22,6 +22,10 @@
     "ExcludeLaunchSettings": {
       "longName": "exclude-launch-settings",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   }
 }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/Angular-CSharp/.template.config/template.json

@@ -67,7 +67,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -115,6 +115,12 @@
       "datatype": "bool",
       "description": "If specified, skips the automatic restore of the project on create.",
       "defaultValue": "false"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     }
   },
   "tags": {

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/Angular-CSharp/.template.config/vs-2017.3.host.json

@@ -27,5 +27,6 @@
     }
   ],
   "excludeLaunchSettings": false,
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/Angular-CSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(NoHttps)
+      "applicationUrl": "http://localhost:5000",
+      //#else
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/Angular-CSharp/Startup.cs

@@ -1,5 +1,8 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
+#if (!NoHttps)
+using Microsoft.AspNetCore.HttpsPolicy;
+#endif
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.SpaServices.AngularCli;
 using Microsoft.Extensions.Configuration;
@@ -38,10 +41,15 @@ namespace Company.WebApplication1
             else
             {
                 app.UseExceptionHandler("/Home/Error");
+#if (!NoHttps)
                 app.UseHsts();
             }
 
             app.UseHttpsRedirection();
+#else
+            }
+
+#endif
             app.UseStaticFiles();
             app.UseSpaStaticFiles();
 

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/React-CSharp/.template.config/dotnetcli.host.json

@@ -22,6 +22,10 @@
     "ExcludeLaunchSettings": {
       "longName": "exclude-launch-settings",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   }
 }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/React-CSharp/.template.config/template.json

@@ -67,7 +67,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -115,6 +115,12 @@
       "datatype": "bool",
       "description": "If specified, skips the automatic restore of the project on create.",
       "defaultValue": "false"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     }
   },
   "tags": {

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/React-CSharp/.template.config/vs-2017.3.host.json

@@ -27,5 +27,6 @@
     }
   ],
   "excludeLaunchSettings": false,
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/React-CSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(NoHttps)
+      "applicationUrl": "http://localhost:5000",
+      //#else
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/React-CSharp/Startup.cs

@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
+#if (!NoHttps)
 using Microsoft.AspNetCore.HttpsPolicy;
+#endif
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.SpaServices.ReactDevelopmentServer;
 using Microsoft.Extensions.Configuration;
@@ -39,10 +41,15 @@ namespace Company.WebApplication1
             else
             {
                 app.UseExceptionHandler("/Home/Error");
+#if (!NoHttps)
                 app.UseHsts();
             }
 
             app.UseHttpsRedirection();
+#else
+            }
+
+#endif
             app.UseStaticFiles();
             app.UseSpaStaticFiles();
 

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/ReactRedux-CSharp/.template.config/dotnetcli.host.json

@@ -22,6 +22,10 @@
     "skipRestore": {
       "longName": "no-restore",
       "shortName": ""
+    },
+    "NoHttps": {
+      "longName": "no-https",
+      "shortName": ""
     }
   }
 }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/ReactRedux-CSharp/.template.config/template.json

@@ -67,7 +67,7 @@
     "HttpsPort": {
       "type": "parameter",
       "datatype": "integer",
-      "description": "Port number to use for the HTTPS endpoint in launchSettings.json."
+      "description": "Port number to use for the HTTPS endpoint in launchSettings.json. This option is only applicable when the parameter no-https is not used (no-https will be ignored if either IndividualAuth or OrganizationalAuth is used)."
     },
     "HttpsPortGenerated": {
       "type": "generated",
@@ -115,6 +115,12 @@
       "datatype": "bool",
       "description": "If specified, skips the automatic restore of the project on create.",
       "defaultValue": "false"
+    },
+    "NoHttps": {
+      "type": "parameter",
+      "datatype": "bool",
+      "defaultValue": "false",
+      "description": "Whether to turn off HTTPS. This option only applies if IndividualAuth or OrganizationalAuth are not being used."
     }
   },
   "tags": {

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/ReactRedux-CSharp/.template.config/vs-2017.3.host.json

@@ -27,5 +27,6 @@
     }
   ],
   "excludeLaunchSettings": false,
-  "minFullFrameworkVersion": "4.6.1"
+  "minFullFrameworkVersion": "4.6.1",
+  "disableHttpsSymbol": "NoHttps"
 }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/ReactRedux-CSharp/Properties/launchSettings.json

@@ -18,7 +18,11 @@
     "Company.WebApplication1": {
       "commandName": "Project",
       "launchBrowser": true,
+      //#if(NoHttps)
+      "applicationUrl": "http://localhost:5000",
+      //#else
       "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      //#endif
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development"
       }

src/Microsoft.DotNet.Web.Spa.ProjectTemplates/content/ReactRedux-CSharp/Startup.cs

@@ -1,6 +1,8 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
+#if (!NoHttps)
 using Microsoft.AspNetCore.HttpsPolicy;
+#endif
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.SpaServices.ReactDevelopmentServer;
 using Microsoft.Extensions.Configuration;
@@ -39,10 +41,15 @@ namespace Company.WebApplication1
             else
             {
                 app.UseExceptionHandler("/Home/Error");
+#if (!NoHttps)
                 app.UseHsts();
             }
 
             app.UseHttpsRedirection();
+#else
+            }
+
+#endif
             app.UseStaticFiles();
             app.UseSpaStaticFiles();
 

test/Templates.Test/MvcTemplateTest.cs

@@ -23,6 +23,16 @@ namespace Templates.Test
         public void MvcTemplate_NoAuth_Works_NetFramework_ForFSharpTemplate()
             => MvcTemplate_NoAuthImpl("net461", languageOverride: "F#");
 
+        [ConditionalFact]
+        [OSSkipCondition(OperatingSystems.Linux | OperatingSystems.MacOSX)]
+        public void MvcTemplate_NoAuth_NoHttps_Works_NetFramework_ForDefaultTemplate()
+            => MvcTemplate_NoAuthImpl("net471", languageOverride: default, true);
+
+        [ConditionalFact]
+        [OSSkipCondition(OperatingSystems.Linux | OperatingSystems.MacOSX)]
+        public void MvcTemplate_NoAuth_NoHttps_Works_NetFramework_ForFSharpTemplate()
+            => MvcTemplate_NoAuthImpl("net471", languageOverride: "F#", true);
+
         [Fact]
         public void MvcTemplate_NoAuth_Works_NetCore_ForDefaultTemplate()
             => MvcTemplate_NoAuthImpl(null, languageOverride: default);
@@ -31,9 +41,9 @@ namespace Templates.Test
         public void MvcTemplate_NoAuth_Works_NetCore_ForFSharpTemplate()
             => MvcTemplate_NoAuthImpl(null, languageOverride: "F#");
 
-        private void MvcTemplate_NoAuthImpl(string targetFrameworkOverride, string languageOverride)
+        private void MvcTemplate_NoAuthImpl(string targetFrameworkOverride, string languageOverride, bool noHttps = false)
         {
-            RunDotNetNew("mvc", targetFrameworkOverride, language: languageOverride);
+            RunDotNetNew("mvc", targetFrameworkOverride, language: languageOverride, noHttps: noHttps);
 
             AssertDirectoryExists("Areas", false);
             AssertDirectoryExists("Extensions", false);
@@ -48,6 +58,18 @@ namespace Templates.Test
             Assert.DoesNotContain("Microsoft.EntityFrameworkCore.Tools.DotNet", projectFileContents);
             Assert.DoesNotContain("Microsoft.Extensions.SecretManager.Tools", projectFileContents);
 
+            if (targetFrameworkOverride != null)
+            {
+                if (noHttps)
+                {
+                    Assert.DoesNotContain("Microsoft.AspNetCore.HttpsPolicy", projectFileContents);
+                }
+                else
+                {
+                    Assert.Contains("Microsoft.AspNetCore.HttpsPolicy", projectFileContents);
+                }
+            }
+
             foreach (var publish in new[] { false, true })
             {
                 using (var aspNetProcess = StartAspNetProcess(targetFrameworkOverride, publish))
@@ -60,11 +82,15 @@ namespace Templates.Test
         }
 
         [ConditionalFact(Skip = "https://github.com/aspnet/templating/issues/378")]
-        [OSSkipCondition(OperatingSystems.Linux)]
+        [OSSkipCondition(OperatingSystems.Linux | OperatingSystems.MacOSX)]
-        [OSSkipCondition(OperatingSystems.MacOSX)]
         public void MvcTemplate_IndividualAuth_Works_NetFramework()
             => MvcTemplate_IndividualAuthImpl("net461");
 
+        [ConditionalFact(Skip = "https://github.com/aspnet/templating/issues/378")]
+        [OSSkipCondition(OperatingSystems.Linux | OperatingSystems.MacOSX)]
+        public void MvcTemplate_WithIndividualAuth_NoHttpsSetToTrue_UsesHttps_NetFramework()
+            => MvcTemplate_IndividualAuthImpl("net471", false, true);
+
         [Fact(Skip = "https://github.com/aspnet/templating/issues/378")]
         public void MvcTemplate_IndividualAuth_Works_NetCore()
             => MvcTemplate_IndividualAuthImpl(null);
@@ -73,7 +99,7 @@ namespace Templates.Test
         public void MvcTemplate_IndividualAuth_UsingLocalDB_Works_NetCore()
             => MvcTemplate_IndividualAuthImpl(null, true);
 
-        private void MvcTemplate_IndividualAuthImpl(string targetFrameworkOverride, bool useLocalDB = false)
+        private void MvcTemplate_IndividualAuthImpl(string targetFrameworkOverride, bool useLocalDB = false, bool noHttps = false)
         {
             RunDotNetNew("mvc", targetFrameworkOverride, auth: "Individual", useLocalDB: useLocalDB);
 
@@ -88,6 +114,11 @@ namespace Templates.Test
             }
             Assert.Contains("Microsoft.VisualStudio.Web.CodeGeneration.Design", projectFileContents);
 
+            if (targetFrameworkOverride != null)
+            {
+                Assert.Contains("Microsoft.AspNetCore.HttpsPolicy", projectFileContents);
+            }
+
             RunDotNetEfCreateMigration("mvc");
 
             AssertEmptyMigration("mvc");

test/Templates.Test/SpaTemplateTest/AngularTemplateTest.cs

@@ -11,13 +11,17 @@ namespace Templates.Test.SpaTemplateTest
         }
 
         [ConditionalFact]
-        [OSSkipCondition(OperatingSystems.Linux)]
+        [OSSkipCondition(OperatingSystems.Linux | OperatingSystems.MacOSX)]
-        [OSSkipCondition(OperatingSystems.MacOSX)]
         // Just use 'angular' as representative for .NET 4.6.1 coverage, as
         // the client-side code isn't affected by the .NET runtime choice
         public void AngularTemplate_Works_NetFramework()
             => SpaTemplateImpl("net461", "angular");
 
+        [ConditionalFact]
+        [OSSkipCondition(OperatingSystems.Linux | OperatingSystems.MacOSX)]
+        public void AngularTemplate_NoHttps_Works_NetFramework()
+            => SpaTemplateImpl("net461", "angular", true);
+
         [Fact]
         public void AngularTemplate_Works_NetCore()
             => SpaTemplateImpl(null, "angular");

test/Templates.Test/SpaTemplateTest/SpaTemplateTestBase.cs

@@ -19,9 +19,9 @@ namespace Templates.Test.SpaTemplateTest
         // Rather than using [Theory] to pass each of the different values for 'template',
         // it's important to distribute the SPA template tests over different test classes
         // so they can be run in parallel. Xunit doesn't parallelize within a test class.
-        protected void SpaTemplateImpl(string targetFrameworkOverride, string template)
+        protected void SpaTemplateImpl(string targetFrameworkOverride, string template, bool noHttps = false)
         {
-            RunDotNetNew(template, targetFrameworkOverride);
+            RunDotNetNew(template, targetFrameworkOverride, noHttps: noHttps);
 
             // For some SPA templates, the NPM root directory is './ClientApp'. In other
             // templates it's at the project root. Strictly speaking we shouldn't have