Enforcing SSL connection

Question

Hello,

A) Can you, at the server side, enforce SSL connection ( via selecting Require Secure Channel option ) only per web application, or can you also enforce it per virtual directory or even only per web page?

B) How exactly does enforcing SSL connection work? That if users specify http instead of https protocol ( in requested URL ), the request will automatically get rejected by IIS?

thanx

Answer 1

Yes and yes.

Answer 2

There may be a configuration setting to enforce this at the IIS level, but in code, you could check the Request.IsSecureConnection value like so:

if (!Request.IsSecureConnection)
{
    try
    {
        Response.redirect("https://....", true);
    }
    catch (ThreadAbortException)
    {}
}

Where "...." is the url for the current page. A good place for this type of code is in the Page_Load method of your MasterLayout.master file.

Answer 3

As stated above, 1) SSL can be set at the server, side, or virtual directory.

2) If the server/site/vdir is configured using the "Require Secure Channel" setting, the response from the server will be a "403.4 Forbidden: SSL is required to view this resource." error or a "403.5 Forbidden: SSL 128 is required to view this resource.".

You can actually customize the 403.4 or 403.5 error to redirect back to HTTPS. Create a VDIR under your site with NO SSL Requirement (**This is Important) - I use "CustomError". Create an ASP File inside this directory called 403_4_Error.asp containing the following:

<%@ LANGUAGE="VBScript" %> 
<%
if Request.ServerVariables("HTTPS") <> "on" then
    sServer = Request.ServerVariables("SERVER_NAME")
    sScript = Request.ServerVariables("SCRIPT_NAME")
    sQuery  = Request.ServerVariables("QUERY_STRING")
    Response.Write("https://" & sServer & sScript & "?" & sQuery)
end if
%>

Edit the server/site/vdir's Custom Error property for 403.4/403.5 and set the MessageType to URL and the URL to "/CustomError/403_4_Error.asp".

Note that ASP is used, you could easily use ASP.net or any other scripting language.

Answer 4

A neat way to do it is to register a HttpModule that examines each incoming request and redirects if necessary: no need for Custom Errors then.

Here's a blog post showing how it's done.