ASP.NET MVC switching between secure to none secure content

Question

After logging to the mvc site using a secure connection (https), calling actions using https connection show up with the user logged in but calling actions using http it bahaves as if user didn't log on.

Since I need to use a virtual directory for https connections(and can't use that directory for http connection) Https links start with: https://www.sitename.com/vdir/... Http links start with: http://www.sitename.com/...

Any idea what's causing this behavior?

Any help greatly appreciated. Thank you!

Jan Jongboom · Accepted Answer · 2010-01-18 10:47:33Z

3

Two different virtual directories cannot share session information in IIS 6, unless your are willing to use SQL State or a state server, and use the (unsafe?) cookieless session mode.

To accomplish the wanted behavior, open both port 80 and port 443 on the main site, so you can access them both with http://sitename.com and https://sitename.com. Then you can switch between http and https whenever you want. Just ditch the idea of different virtual directories for different protocols.

answered Jan 18, 2010 at 10:47

Jan Jongboom

27.5k10 gold badges85 silver badges121 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Debra Over a year ago

Thanks you! Since it was shared ssl (it's just a test site) I was forced to use a special virtual directory for the https connection. Will this be fine when I use the same directory for both (opening 80 and 443 ports)? Do all subdirectories share session info? According to the hosting company it's on IIS7, would that make a difference?

Jan Jongboom Over a year ago

You will need to enforce session sharing in IIS 7 between VD's. It's possible afaik, but I've never used it myself. If you have one website with multiple ports this will work as expected. Multiple subdirectories will share the same session as long as they are in the same virtual directory/website.

Jan Jongboom Over a year ago

Hmm, I cannot find any prove for my earlier statement that this was possible in IIS 7. If anyone finds info on how to configure this, please add this to the answer :-)

Debra Over a year ago

Thank you Jan! In the real site we'll have our own certificate so that should be fine.

Collectives™ on Stack Overflow

ASP.NET MVC switching between secure to none secure content

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related