Force entire site HTTPS using Web.Config

6 Sep 2006 1:39 PM

curt.ziegler

I know this can be done in IIS, and it may even be the preferred method
but can someone help me redirect every http request to https? I think
it could be done in the global.asax.cs or web.config but would like to
know the best way first...

Thank you for any help.
Curt

6 Sep 2006 2:41 PM

Mark Rae

<curt.zieg***@gmail.com> wrote in message

news:1157549973.066023.303520@d34g2000cwd.googlegroups.com...

>I know this can be done in IIS, and it may even be the preferred method
> but can someone help me redirect every http request to https? I think
> it could be done in the global.asax.cs or web.config but would like to
> know the best way first...

I've never found anything better than this:
http://www.codeproject.com/aspnet/WebPageSecurity_v2.asp?select=1095511&df=100&forumid=53615&exp=0

6 Sep 2006 3:12 PM

curt.ziegler

Thanks Mark,

I have this for now, I'll try that next & see if there are any
differences in speed

protected void Application_BeginRequest(Object sender, EventArgs e)
{
   if (HttpContext.Current.Request.IsSecureConnection.Equals(false))
   {
    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
+   HttpContext.Current.Request.RawUrl);
   }
}

Mark Rae wrote:
Show quoteHide quote

> <curt.zieg***@gmail.com> wrote in message
> news:1157549973.066023.303520@d34g2000cwd.googlegroups.com...
>
> >I know this can be done in IIS, and it may even be the preferred method
> > but can someone help me redirect every http request to https? I think
> > it could be done in the global.asax.cs or web.config but would like to
> > know the best way first...
>
> I've never found anything better than this:
> http://www.codeproject.com/aspnet/WebPageSecurity_v2.asp?select=1095511&df=100&forumid=53615&exp=0

6 Sep 2006 3:54 PM

Mark Rae

<curt.zieg***@gmail.com> wrote in message
Show quoteHide quote

news:1157555574.139109.181570@b28g2000cwb.googlegroups.com...

> Thanks Mark,
>
> I have this for now, I'll try that next & see if there are any
> differences in speed
>
> protected void Application_BeginRequest(Object sender, EventArgs e)
> {
>   if (HttpContext.Current.Request.IsSecureConnection.Equals(false))
>   {
>    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
> +   HttpContext.Current.Request.RawUrl);
>   }
> }

I'm sure that will work OK for the single requirement that you have, whereas
WebPageSecurity.dll forces individual folders and files to be secure or not