How to step out from https to http mode in asp.net mvc.

Question

I have made my Login page as Https enabled by adding the attribute [RequireSSL] on controller Action and it works fine. But after successful login it remains in https environment, however the page is non https page. Can anybody give me workaround how to step out from https to http mode? Any help in this regard will be greatly appreciated.

Answer 1

You basically need to do the opposite, which is have a [DoesNotRequireSSL] attribute, which effectively does the opposite of the {RequireSSL] attribute, i.e., redirect to http protocol

public class DoesNotRequireSSL: ActionFilterAttribute 
    {
     public override void OnActionExecuting(ActionExecutingContext filterContext) 
     {
      var request = filterContext.HttpContext.Request;
      var response = filterContext.HttpContext.Response;

      if (request.IsSecureConnection && !request.IsLocal) 
      {
      string redirectUrl = request.Url.ToString().Replace("https:", "http:");
      response.Redirect(redirectUrl);
      }
      base.OnActionExecuting(filterContext);
     }
    }

Also, if you would like to ensure that multiple pages have this behaviour, you can set up a base controller, from which all your non-http controllers can inherit from so you dont have to worry about having to repeat yourself for every page which needs this.

Answer 2

CAUTION: I had a similar question. One important thing I learnt was that your auth cookie will be sent over plain text after switching back to HTTP. See this.

CAUTION 2 : Don't forget to consider the dreaded You are about to be redirected to a connection that is not secure message

If you're writing a bank application you need to be real careful - and also realize the increasing number of users on public wifi connections that could well [esily] be funneled through some sneaky proxy. Probably a much bigger concern for mainstream sites but a concern for us all to be aware of.

See also my other question (no answers at time of writing - but then I only just asked it!)