microsoft/aspire · error · NotSupportedException

Endpoint ' ' on project resource ' ' is exposed through…

Error message

Endpoint '{resolvedEndpoint.Endpoint.Name}' on project resource '{resource.TargetResource.Name}' is exposed through Azure sandbox ingress, which terminates TLS and forwards plaintext HTTP. Add an HTTP endpoint that shares this endpoint's target port.

What it means

Azure sandbox ingress terminates TLS and forwards plaintext HTTP to project targets. When a project resource exposes an HTTPS endpoint whose target port has no matching HTTP endpoint, the sandbox cannot forward traffic, so deployment validation throws NotSupportedException.

Solutions

Add an HTTP endpoint on the project that shares the HTTPS endpoint's target port (WithEndpoint with scheme "http" and the same target port)
Or remove the HTTPS-only requirement and expose the endpoint as http
Or host the project in a container resource where TLS handling differs

Example fix

// before
var api = builder.AddProject<Projects.Api>("api").WithHttpsEndpoint(port: 443, targetPort: 8080);
// after
var api = builder.AddProject<Projects.Api>("api")
    .WithHttpEndpoint(targetPort: 8080)
    .WithHttpsEndpoint(port: 443, targetPort: 8080);

Defensive patterns

Strategy: validation

Validate before calling

var httpsPorts = project.Endpoints.Where(e => e.UriScheme == "https").Select(e => e.TargetPort);
foreach (var port in httpsPorts)
    if (!project.Endpoints.Any(e => e.UriScheme == "http" && e.TargetPort == port))
        throw new InvalidOperationException($"Add an http endpoint sharing target port {port} for sandbox deploy.");

Try / catch

try { DeploySandbox(...); } catch (NotSupportedException ex) when (ex.Message.Contains("terminates TLS and forwards plaintext HTTP")) { /* add matching http endpoint */ }

Prevention

Always pair https endpoints with an http endpoint on the same target port for sandbox deploys
Test publish/deploy locally before CI

When it happens

Trigger: Deploying a ProjectResource to an Azure sandbox where a resolved endpoint has UriScheme https and no other resolved endpoint with UriScheme http shares the same TargetPort.

Common situations: Project templates or WithEndpoint calls configured with only an https endpoint; projects that enable HTTPS-only endpoints locally then deployed to a sandbox.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/d11970c0ba0992df. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs:1497

            static endpoint => endpoint.Name!,
            StringComparer.OrdinalIgnoreCase);
        var unmatchedEndpointOptions = endpointOptions is null ? null : new HashSet<string>(endpointOptions.Keys, StringComparer.OrdinalIgnoreCase);
        var resolvedEndpoints = resource.TargetResource.ResolveEndpoints();
        var endpoints = new Dictionary<int, SandboxEndpoint>();
        foreach (var resolvedEndpoint in resolvedEndpoints)
        {
            if (!resolvedEndpoint.Endpoint.IsExternal)
            {
                continue;
            }

            if (resource.TargetResource is ProjectResource &&
                string.Equals(resolvedEndpoint.Endpoint.UriScheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase) &&
                !resolvedEndpoints.Any(candidate =>
                    string.Equals(candidate.Endpoint.UriScheme, Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase) &&
                    candidate.TargetPort.Value == resolvedEndpoint.TargetPort.Value))
            {
                throw new NotSupportedException(
                    $"Endpoint '{resolvedEndpoint.Endpoint.Name}' on project resource '{resource.TargetResource.Name}' is exposed through Azure sandbox ingress, which terminates TLS and forwards plaintext HTTP. " +
                    "Add an HTTP endpoint that shares this endpoint's target port.");
            }

            var targetPort = ResolveSandboxTargetPort(resource.TargetResource, resolvedEndpoint);

            if (targetPort is not int resolvedTargetPort)
            {
                throw new InvalidOperationException($"Endpoint '{resolvedEndpoint.Endpoint.Name}' on resource '{resource.TargetResource.Name}' does not have a target port. Configure a target port before deploying it to an Azure sandbox.");
            }

            var protocol = ResolveSandboxPortProtocol(resource.TargetResource, resolvedEndpoint.Endpoint);
            AzureSandboxEndpointOptions? resolvedEndpointOptions = null;
            endpointOptions?.TryGetValue(resolvedEndpoint.Endpoint.Name, out resolvedEndpointOptions);
            unmatchedEndpointOptions?.Remove(resolvedEndpoint.Endpoint.Name);
            var endpoint = new SandboxEndpoint(
                resolvedEndpoint.Endpoint.Name,
                resolvedTargetPort,

View on GitHub (pinned to 25830f84bd)