Part 9 AppHost HTTP launch profile fails under Aspire

[jongalloway]

Issue type

bug

Requested priority

P2 - A workaround exists, an optional path is broken, or significant drift exists

Workshop area

Part 9 - Adding AI to an Existing App

Summary

The committed http launch profile in both Part 9 AppHost snapshots fails before resources start because Aspire rejects a non-HTTPS applicationUrl unless unsecured transport is explicitly allowed.

The README's default dotnet run --project eShopLite.AppHost command works because it selects the HTTPS profile, so the primary attendee flow is not blocked.

Attendee or instructor impact

Anyone explicitly selecting the HTTP profile from the CLI or IDE receives an Aspire startup failure. The presence of a committed profile implies that it is supported, and instructors may select it while diagnosing local certificate or HTTPS issues.

The workaround is to use the default HTTPS profile or set ASPIRE_ALLOW_UNSECURED_TRANSPORT=true for the HTTP profile.

Reproduction or proposed change

From either Part 9 snapshot or a clean scratch copy, run:

dotnet run --project eShopLite.AppHost --launch-profile http

Observed error under Aspire 13.4.6:

The 'applicationUrl' setting must be an https address unless the
'ASPIRE_ALLOW_UNSECURED_TRANSPORT' environment variable is set to true.

The default command succeeds:

dotnet run --project eShopLite.AppHost

Proposed change:

1. Update both:
   • Part 09 - Adding AI to an Existing App/eShopLite-start/eShopLite.AppHost/Properties/launchSettings.json
   • Part 09 - Adding AI to an Existing App/eShopLite/eShopLite.AppHost/Properties/launchSettings.json
2. Either add ASPIRE_ALLOW_UNSECURED_TRANSPORT=true to the HTTP profile's environment variables or remove the unsupported profile.
3. Keep the start and completed snapshots aligned.
4. If unsecured transport is retained, add a brief explanation that it is local-development-only.

Expected outcome

Every committed launch profile starts successfully, or unsupported profiles are removed so the project exposes only valid launch choices.

Validation

• Run both eShopLite-start and eShopLite from scratch copies.
• Start the default profile and confirm Products and Store become healthy.
• Start the explicit HTTP profile and confirm Products and Store become healthy.
• Build both solutions in Release with zero warnings.
• Confirm launch-setting changes are identical in the paired snapshots.

Dependencies and related issues

The separate Aspire-version PR mentioned during triage may alter the exact behavior. Revalidate this issue after that PR lands and close it if the profile becomes valid without an explicit setting.

[jongalloway]

Revalidated after the Aspire 13.4.6 workshop update in the 2026-09-13 end-to-end run at commit 6040eaf. The default HTTPS profile starts successfully, but dotnet run --project eShopLite.AppHost --launch-profile http still fails unless ASPIRE_ALLOW_UNSECURED_TRANSPORT=true is supplied. The issue therefore remains applicable to both start and answer snapshots under the new baseline.