asp.net mvc 5 - Should I be able to test AuthorizeAttribute and RequireHttpsAttribute with localhost? -

i have been building mvc 5 month now. before deep in project want make sure security done , build secure web site. have created 5 pages should available , implement aspnet.idenity. first wanted test following works expected. expecting pages fail security reasons except home page. based on research if add:

public static void registerglobalfilters(globalfiltercollection filters) {     filters.add(new handleerrorattribute());     filters.add(new system.web.mvc.authorizeattribute());     filters.add(new requirehttpsattribute()); } 

every page should require https , logged in user. decorated home, index controller [allowanonymous] can land on 1 page when start project. expecting every other page fail, or error or redirect login (not sure how since not https yet).

but every page works no problems. should able test using localhost, or need server environment iis? understand that possibility http, think authorizeatribute should tested , fail. not doing right?

yes.

but authorizeattribute depends on implementation of iprincipal , iidentity in order function. not work without first implementing choice of authentication model.

and requirehttpsattribute requires have ssl certificate installed on local iis in order function correctly.

but once dependencies added make attributes function, function locally same on web server.