CODEWITHSUNDEEP
asp.net-mvcasp.net-mvc-3visual-studio-2010sslsecurity
neizan
neizan

Reputation: 2321

asp.net mvc 3 - don't have option in project properties for "SSL Enabled"

I'm following the Pluralsight ASP.NET MVC 3 tutorial, module 7 - Security (which, by the way, is a great tutorial). In the Authorization section, at the 6:24 mark, it shows how to set the project property of SSL Enabled to true. My problem is, when I get into the project properties, I do not have that option. I only see Always Start When Debugging, Project File, and Project Folder. Does anyone know why I don't have the option for SSL Enabled, how I could make it appear, or a different way I can achieve the same result? I'm using Visual Studio 2010 SP1Rel.

In other reading, I saw someting about the setting requireSSL="true" in the Web.config file, under the authentication tag. Does this do the same thing as setting SSL Enabled = true under project properties? If not, could anyone give a brief explanation of the difference or point me to a good article? Thanks.

Upvotes: 7

Views: 6096

Answers (3)

neizan
neizan

Reputation: 2321

I just figured out that this option is available if using IIS Express in the development environment, but not if using the VS Development Server, which my project was using. I solved my problem by right-clicking on the project in the Project Explorer window, then selecting "Configure Project for IIS" or something to that effect. Now the option for SSL Enabled shows up in the properties.

By the way, this is the web page that helped me figure out my problem.

Also, even though I figured out my primary question, I'd still be interested in any comments regarding my secondary question.

[EDIT] The shortcut to setting this is to right click on your project name in "Solution Explorer" and click Properties...In the Properties window, click on the "Web" tab, and then under "Servers" change the dropdown box to "IIS Express".

Upvotes: 8

RickAndMSFT
RickAndMSFT

Reputation: 22860

See my blog http://blogs.msdn.com/b/rickandy/archive/2011/04/22/better-faster-easier-ssl-testing-for-asp-net-mvc-amp-webforms.aspx
I recommend testing with IIS 7.5 (localserver) - see Test your ASP.NET MVC or WebForms Application on IIS 7 in 30 seconds The right way to require SSL is via 

filters.Add(new System.Web.Mvc.RequireHttpsAttribute());

See my blog post Securing your ASP.NET MVC 4 App and the new AllowAnonymous Attribute

Upvotes: 1

HatSoft
HatSoft

Reputation: 11201

The RequireSSL property set in the configuration file for an ASP.NET application by using the requireSSL attribute of the forms configuration element.

Given that you are using asp.net mvc you can mark an action to be secure

like this:

[RequireHttps]
public ActionResult Login()
{
   return View();
}

Upvotes: 1

Related Questions