ansaurus

Question

IHTTPModule to switch between HTTP and HTTPS in ASP.NET

Answer 1

+3 A:

I would suspect, that when you determine which resources require encryption, and which not, you do not include the images, or some header and footers as well, or even CSS files, if you use any.

As you always throw away SSL for such a content, it may happen that part of the page (main html) requires SSL, but the consequential request for an image on this page does not.

The browser is warning you, that some parts of the page were not delivered using SSL.

I will check if the request is for HTML, and only then drop the SSL if needed. Otherwise, keep it the way it is (most probably images and such are referenced with relative paths, than a full blown url).

I.e., if you have:

<html>
<body>
   Some content...
   <img src="images/someimage.jpg">
</body>
</html>

and you request this page using SSL, but your evaluation of requestRequiresSSL does not take into account the images as secured resources, it will form a http, not https request, and you will see the warning.

Make sure when you request a resource and evaluate requestRequiresSSL, to check the referrer and if this is an image:

// SSL not required but current connection is SSL
if (!requestRequiresSSL && ctx.Request.IsSecureConnection && !isHtmlContent)
   ctx.Response.Redirect("http://www.myurl.com" + pathAndQuery);

Just figure out how to determine isHtmlContent (if you do not serve images from a database, etc., but from a disk location), just check the the resource filename (.aspx, .asmx, .ashx, .html, etc.).

That way, if the connection is encrypted, but the resource itself is not html, and no set for "encryption", you are not going to drop the encryption.

Sunny 2009-03-05 22:43:00

In this scenario, my httpmodule basically ignores the request. I see what you're saying about checking the requestRequiresSSL property of the referrer. But what should the module do in that case? I shouldn't do a redirect on a request for non-html content, so I'm not sure how to proceed there.

George Durzi 2009-03-06 04:07:27

edited the answer.

Sunny 2009-03-06 15:03:34

Thanks Sunny, I made this little tweak and it works great.

George Durzi 2009-03-06 21:41:21

Answer 2

A:

Any content that is not normally handled by .Net (such as regular html and most graphic files) will not execute the httpmodule because it doesn't go through .net

Your best bet is to just handle this at the IIS level. See the following for info on how to configure your server.

http://www.jameskovacs.com/blog/HowToAutoRedirectToASSLsecuredSiteInIIS.aspx

Chris Lively 2009-03-05 23:28:53

Chris, the only issue here is that this is a CMS where content authors can create sites and set a "RequireSSL" property on them. The sites are stored in the CMS database but not in IIS.

George Durzi 2009-03-06 04:03:39

Answer 3

+1 A:

I highly recommend using this (free / open source) component to do what you're trying:

http://www.codeproject.com/KB/web-security/WebPageSecurity_v2.aspx

Keltex 2009-03-06 00:04:47

Thanks Keltex, I'll give that a shot tomorrow

George Durzi 2009-03-06 04:15:02

Answer 4

A:

I highly recommend you this product:

http://www.e2xpert.com/web/Http-Https-Switch.aspx

It is professional and easy to use. It comes with a powerful configuration tool, by which just one click can finish the entire configuration for you.

Mirrorlu 2009-12-02 03:37:06

Answer 5

A:

Just use SSL throughout your site, for all pages and for all images/scripts/stylesheets. That just makes everything oh-so-simple. IE and Firefox will no longer complain, you will no longer have crazy modules trying to guess whether any given request should be redirected, etc.

Justice 2009-12-02 03:41:19

ansaurus

tags:

views:

answers:

IHTTPModule to switch between HTTP and HTTPS in ASP.NET

related questions