Linking from a https page

Question

This sounds like it should be a common problem but I can find little solutions to it.

Basically relative links on a https page (often found within controls and the master page) will obviously link to non-secure pages as https which is undesirable.

A possible solution was to use the base tag in the head of the page to root all relative pats to http but then any relative resources within the secure page will be rooted to http which is also undesirable.

I thought about overriding the render method and if it a secure page then rewrite all relative links on the page to be http.

How should it be done?

Answer 1

You mean all absolute URL's? The answer is you don't use absolute urls. You use relative ones (/foo instead of http://example.org/foo).

Answer 2

One way is to implement e.g. an IHttpModule which checks incoming requests, decides from the URL whether they should be on http: or https:, and if the request is using the "wrong" protocol, issues a redirect to use the "right" protocol.

Update: I found another question where the answers give more details on the pluses and minuses of this approach. Here's an interesting link from that thread.

Answer 3

I tend to override the System.Web.UI.Page class and add an IsSecure attribute. You can then set this in the Page directive:

<%@ Page Language="C#" MasterPageFile="~/Default.Master" AutoEventWireup="true" 
CodeBehind="Foo.aspx.cs" Inherits="Bar.Foo" IsSecure="true" %>

In your own page class you can then override OnPreInit to do the redirect using something like this:

if (IsSecure && Request.Url.Scheme == "http")
{
    string targetUrl = String.Format(
                           "https://{0}{1}",
                           Request.Url.Host,
                           Request.RawUrl);
    Response.Redirect(targetUrl);
}
else if (!IsSecure && Request.Url.Scheme == "https")
{
    string targetUrl = String.Format(
                           "http://{0}{1}", 
                           Request.Url.Host, 
                           Request.RawUrl);
    Response.Redirect(targetUrl);
}

All of your pages will need to inherit from your own page class rather than the one in System.Web.UI, but once that's sorted you're good to go.

P.S. All of this code is from memory, so may be flaky (I can never remember if the application directory is included in RawUrl, for example) but the concept is there.

Answer 4

Ok I have implemented a solution that rewrites relative links if on a ssl page by overriding the render method. I take the point silky made about it being bad form to redirect away from ssl, but I also think its bad form to use ssl on pages that don't post user information.

I would still be intereseted to hear how others deal with this problem.

Anyway heres my solution. I use HtmlAgilityPack to parse the html but you could use a regex if you prefer.

protected override void Render(System.Web.UI.HtmlTextWriter writer)
    {
        if (HttpContext.Current.Request.Url.Scheme == "https")
        {
            StringBuilder stringBuilder = new StringBuilder();
            HtmlTextWriter pageTextWriter = new HtmlTextWriter(new StringWriter(stringBuilder, System.Globalization.CultureInfo.InvariantCulture));
            base.Render(pageTextWriter);

            HtmlAgilityPack.HtmlDocument htmldoc = new HtmlAgilityPackHtmlDocument();
            htmldoc.LoadHtml(stringBuilder.ToString());
            HtmlAgilityPack.HtmlNodeCollection linkNodes = htmldoc.DocumentNode.SelectNodes("//a[@href]");
            if (linkNodes != null)
            {
                Uri baseUri = new Uri("http://www.mynonsslwebroot.co.uk/");
                foreach (HtmlAgilityPack.HtmlNode node in linkNodes)
                {
                    Uri uri;

                    if (Uri.TryCreate(baseUri, node.Attributes["href"].Value, out uri))
                    {
                        node.Attributes["href"].Value = uri.OriginalString;
                    }
                }
                writer.Write(htmldoc.DocumentNode.WriteTo());
            }
        }
        else
        {
            base.Render(writer);
        }
    }

Answer 5

Keep in mind the existence of protocol-independent absolute URLs (e.g. //example.com/images/artwork.jpg). Such a URL will be an https URL IFF the current base page is an https page.