ansaurus

Question

Partial SSL in ASP.NET Webforms without changing IIS configuration

Answer 1

A:

I found the easiest way to do this is by adding code to the specific page that checks if the current request is using HTTPS. If it isn't, do a redirect to the same URL using HTTPS. Then, that whole page will load using SSL. Then, make sure that links or redirects to other pages use absolute HTTP. In other words, SSL can be enabled but not required for the whole site, and the web site's links will control when it gets used.

One way to make sure that all relative links on the site point to non-HTTPS URLs even if the current page is currently using HTTPS is to use the HTML base tag:

<head> 
  <base href="http://yourdomain/" /> 
</head>

Jacob 2009-11-09 00:54:58

Thx Jacob. What about the master page on the root folder, and images and css file? All of them will load using SSL, when the secured page is requested by the client?Also, is there any way to change the links dynamically so they don't need the absolute URL?

Leonardo 2009-11-09 01:17:04

Yes, the master page and all its linked-to resources would come in as HTTPS as well, so that should avoid the "secure and non-secure" message.

Jacob 2009-11-09 19:00:06

Answer 2

A:

SSL works on site level, not on folder level. Once you install SSL certificate your website could be accessed using https protocol, like so: https://www.example.com. At the same time, your website is still accessible at http://www.example.com - no performance issues.

Images and CSS files will be loaded using https protocol, as long as you use relative paths. Master page never gets requested by client separately so SLL doesn't really apply here.

Use this code to have absolute URL for a link:

<a href='<%= "https://" + Request.Url.Host + Page.ResolveUrl("~/Secure.aspx") %>'>Click me</a>

Pavel Chuchuva 2009-11-09 06:40:13

Answer 3

A:

I ended up overriding the OnInit method on the page I wanted to secure, using the solution described here:

protected override void OnInit(EventArgs e)
{
    if (!Request.IsSecureConnection && !Request.IsLocal)
    {
        UriBuilder builder = new UriBuilder(Request.Url)
        {
            Scheme = Uri.UriSchemeHttps,
            Port = 443
        };
        Response.Redirect(builder.Uri.ToString());
    }
    base.OnInit(e);
}

For the rest of the pages, I inherited from a base page with the following code on the OnInit method:

protected override void OnInit(EventArgs e)
{
    if (Request.IsSecureConnection)
    {
        UriBuilder builder = new UriBuilder(Request.Url)
        {
            Scheme = Uri.UriSchemeHttp,
            Port = 80
        };
        Response.Redirect(builder.Uri.ToString());
    }
    base.OnInit(e);
}

Leonardo 2010-03-03 05:33:49

ansaurus

tags:

views:

answers:

Partial SSL in ASP.NET Webforms without changing IIS configuration

related questions