http://samueleresca.net/2015/01/enforce-https-web-api-services/

requireHttpsAttribute.cs

public class RequireHttpsAttribute : AuthorizationFilterAttribute
{
	
	public override void OnAuthorization(HttpActionContext contextOfAction) {
		if (contextOfAction.Request.RequestUri.Scheme != Uri.UriSchemeHttps)
		{
					contextOfAction.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden)
				{
					ReasonPhrase = "HTTPS Required"
				};
		}
		else {
			base.OnAuthorization(contextOfAction);
		}
	
	}
}