Automatically Switching Between HTTP and HTTPS asp.net

Question

I am in asp.net web forms paradigm (api implemented with APIController from MVC). I have added following bindings in IISExpress

http://sarfraz-pc:80
https://sarfraz-pc:443

using this great article. I can access the entire site either using http or https. Now, I want to force some pages to run on http while other on https. Google gave me lots of results including a very old solution from code project and the other one called Security Switch.

But I am seriously considering using IIS 7.0's url rewrite module to implement this. Has anybody used URL rewriting for this purpose? I don't know url rewriting in detail so I want to ask is there a drawback in taking this route? If yes, please suggest some alternative approach (including ones I mentioned) but it should not be simply writing the Response.Redirect code here and there in the application.

You cannot handle this with a server side redirect. The client must be redirected. — Marcus Adams
– Marcus Adams, Commented Jul 12, 2012 at 13:35
Marcus are you sure of this? I mean have you gone through weblogs.asp.net/owscott/archive/2011/02/26/… — Muhammad Adeel Zahid
– Muhammad Adeel Zahid, Commented Jul 12, 2012 at 16:01
For HTTPS, HTTP is layered on top of SSL/TLS. Once you start HTTP, it can't suddenly become HTTPS, or vice versa. It has to be a new connection, so the client must be involved. — Marcus Adams
– Marcus Adams, Commented Jul 12, 2012 at 16:15
In that video the speaker talks about 301 permanent redirect and I believe it is a client side redirect. no? — Muhammad Adeel Zahid
– Muhammad Adeel Zahid, Commented Jul 12, 2012 at 16:51
Just keep in mind that if those HTTPS pages are accessed by an authenticated user then you shouldn't be making any requests to HTTP. In fact the auth cookie should be marked secure to ensure it won't be sent over an insecure connection. More info: troyhunt.com/2011/11/… — Troy Hunt
– Troy Hunt, Commented Jul 18, 2012 at 2:32

Mike · Accepted Answer · 2012-07-12 12:15:56Z

4

Add this code to your global.asax file to inspect every request and convert on the fly.

protected void Application_BeginRequest(Object sender, EventArgs e)
{
   if (HttpContext.Current.Request.IsSecureConnection.Equals(false) && HttpContext.Current.Request.IsLocal.Equals(false))
   {
    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
+   HttpContext.Current.Request.RawUrl);
   }
}

answered Jul 12, 2012 at 12:15

Mike

1,97414 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Marcus Adams Over a year ago

+1 I don't know if the OP is looking for a global answer, but this demonstrates the proper method to detect if the connection is using HTTPS and if not, redirect. Though, it also allows local access without HTTPS.

freefaller · Accepted Answer · 2012-07-12 11:53:19Z

2

Although it's not using URL Rewrite (which I have only a small amount of experience with), we deal with it via custom errors in IIS.

Set the custom error of "403.4" (SSL Required) to a URL such as "/Error/403_4.aspx".
Set the directory/directories to "Require SSL".

Then have in 403_4.aspx...

Private Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles MyBase.Load
  Dim url As String = Request.Url.Query
  url = url.Replace("?403;", "")
  Dim port As String = String.Format(":{0}/", New Uri(url).Port)
  If url.IndexOf(port) <> -1 Then
    url = url.Replace(port, "/")
  End If
  url = url.Replace("http://", "https://")
  Response.Redirect(url, True)
End Sub

I know it's not exactly what you're after, but it's better than having the redirection in multiple places in the code.

answered Jul 12, 2012 at 11:53

freefaller

20.1k7 gold badges62 silver badges96 bronze badges

2 Comments

Muhammad Adeel Zahid Over a year ago

you right: this is not what I am after. I would consider it if someone tells me that URL rewriting is not meant for this purpose

freefaller Over a year ago

Not a problem @Muhammad, would be interested to see responses regarding URL Rewrite myself.

Collectives™ on Stack Overflow

Automatically Switching Between HTTP and HTTPS asp.net

2 Answers 2

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related