Forcing SSL (https) on a page by page basis

Question

How can I set up my page load event in my code behind to redirect to an url that has an https prefix? I would need it to work with urls that have query strings attached too.

It's one thing to construct a link that goes straight to the https page, but I don't want the user to be able to manually change it to an http page.

Also I don't want to do it with javascript because it might be turned off.

I'm guessing a regular expression?

Answer 1

Add this at the top of your Page_Load

if (Request.ServerVariables["HTTPS"] != "ON")
{
    Response.Redirect("https://" + Request["HTTP_HOST"] + Request.RawUrl);
}

Answer 2

We mark our SSL Required pages with a special attribute ForceSslAttribute. Then we have a HttpModule that pulls down the current page's class and inspect it's attributes.

If the attribute is present on the page, it takes the exact url that was passed and changes the protocol from http to https then calls a redirect.

There's probably a bit simpler way of doing it, but that's how it's done for us.

Attribute:

[AttributeUsage(AttributeTargets.Class, AllowMultiple=false, Inherited=true)]
public sealed class ForceSslAttribute : Attribute
{
    // Marker Attribute
}

Page Example (CodeBehind):

[ForceSsl]
public partial class User_Login : Page
{
    //...
}

You can figure out the type of the page like this:

HttpContext.Current.CurrentHandler.GetType()

All Page's implement IHttpHandler and when you're visiting a page, it'll work.

The cool part about this method is you can mark anything that's an IHttpHandler and it'll force the redirect too :)

Answer 3

I use the following in Global.asax Application_BeginRequest

If needsSSL <> Request.IsSecureConnection Then
    If needsSSL Then
        Response.Redirect(Uri.UriSchemeHttps + Uri.SchemeDelimiter + Request.Url.Host +  Request.Url.PathAndQuery, True)
    Else
        Response.Redirect(Uri.UriSchemeHttp + Uri.SchemeDelimiter + Request.Url.Host + Request.Url.PathAndQuery, True)
    End If
End If

Answer 4

There is an IIS7 module for URL rewriting. Very handy, but you need access to the IIS and it requires some time to learn how to write the rules. A simple http->https rule is a matter of seconds.

Just be careful because any rules you add will be stored in your web.config, so don't delete/override it or you will have to write them again.