CODEWITHSUNDEEP
c#asp.net
The Muffin Man
The Muffin Man

Reputation: 20004

Forcing SSL (https) on a page by page basis

How can I set up my page load event in my code behind to redirect to an url that has an https prefix? I would need it to work with urls that have query strings attached too.

It's one thing to construct a link that goes straight to the https page, but I don't want the user to be able to manually change it to an http page.

Also I don't want to do it with javascript because it might be turned off.

I'm guessing a regular expression?

Upvotes: 2

Views: 2420

Answers (5)

Manik Arora
Manik Arora

Reputation: 4792

Forcing SSL using ASP To force SSL using ASP, follow these steps:

Click Start, click Run, type Notepad, and then click OK.
Paste the following code into a blank Notepad document. On the File menu, click Save As, and then save the following code in the root of your Web server as an include file named ForceSSL.inc:

<%
   If Request.ServerVariables("SERVER_PORT")=80 Then
      Dim strSecureURL
      strSecureURL = "https://"
      strSecureURL = strSecureURL & Request.ServerVariables("SERVER_NAME")
      strSecureURL = strSecureURL & Request.ServerVariables("URL")
      Response.Redirect strSecureURL
   End If
%>


For each page that requires SSL, paste the following code at the top of the page to reference the include file from the previous step:

<%@Language="VBSCRIPT"%>
<!--#include virtual="/ForceSSL.inc"-->


When each page is browsed, the ASP code that is contained in the include file detects the port to determine if HTTP is used. If HTTP is used, the browser will be redirected to the same page by using HTTPS.

Upvotes: 0

Erik
Erik

Reputation: 1

There is an IIS7 module for URL rewriting. Very handy, but you need access to the IIS and it requires some time to learn how to write the rules. A simple http->https rule is a matter of seconds.

Just be careful because any rules you add will be stored in your web.config, so don't delete/override it or you will have to write them again.

Upvotes: 0

radimd
radimd

Reputation: 510

I use the following in Global.asax Application_BeginRequest

If needsSSL <> Request.IsSecureConnection Then
    If needsSSL Then
        Response.Redirect(Uri.UriSchemeHttps + Uri.SchemeDelimiter + Request.Url.Host +  Request.Url.PathAndQuery, True)
    Else
        Response.Redirect(Uri.UriSchemeHttp + Uri.SchemeDelimiter + Request.Url.Host + Request.Url.PathAndQuery, True)
    End If
End If

Upvotes: 1

Aren
Aren

Reputation: 55946

We mark our SSL Required pages with a special attribute ForceSslAttribute. Then we have a HttpModule that pulls down the current page's class and inspect it's attributes.

If the attribute is present on the page, it takes the exact url that was passed and changes the protocol from http to https then calls a redirect.

There's probably a bit simpler way of doing it, but that's how it's done for us.

Attribute:

[AttributeUsage(AttributeTargets.Class, AllowMultiple=false, Inherited=true)]
public sealed class ForceSslAttribute : Attribute
{
    // Marker Attribute
}

Page Example (CodeBehind):

[ForceSsl]
public partial class User_Login : Page
{
    //...
}

You can figure out the type of the page like this:

HttpContext.Current.CurrentHandler.GetType()

All Page's implement IHttpHandler and when you're visiting a page, it'll work.

The cool part about this method is you can mark anything that's an IHttpHandler and it'll force the redirect too :)

Upvotes: 2

tidwall
tidwall

Reputation: 6949

Add this at the top of your Page_Load

if (Request.ServerVariables["HTTPS"] != "ON")
{
    Response.Redirect("https://" + Request["HTTP_HOST"] + Request.RawUrl);
}

Upvotes: 2

Related Questions