473,804 Members | 2,085 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Detecting Secure requesting when hardware based SSL offloading is

Hi.
We have an ASP.net Web application in which some of the pages are to be
served over secure channel using HTTPS.
We have built a framework that allows pages to be served over secure channel
specified in a configuration file. When a request for specified pages comes
over HTTP, framework detects and redirects the browser over HTTPS.
Similarly for non secure pages if the request comes over HTTPS the
framework redirects the browser onto HTTP.

We use HttpRequest.IsS ecureConnection property to determine HTTP/HTTPS was
used to make the request. This all used to work fine until now.

Now the infrastructure group has taken out SSL responsibilitie s from the Web
Server and given it to an Hardware SSL offloader. What SSL offloader is doing
is it decrypts the request from client and sends an un encrypted request to
Web Server.
As a consequence HttpRequest.IsS ecureConnection is always returning false
to the application?

Is anyone aware of a solution to the above problem i.e. for us to detect SSL
request in SSL Offloading scenario by other means than using
HttpRequest.IsS ecureConnection (for e.g. checking headers??)

Thanks
Nov 19 '05 #1
1 2624
If I understood correctly.. nope. If they are removing the request from the
HTTPS context, and rerouting to an HTTP URL in the backend then you are
probably out of luck. The offloader will be your only point of reference. If
the call comes from there, or if they can pass an additional flag, you should
be able to get to that.

--
Curt Christianson
site: http://www.darkfalz.com
blog: http://blog.darkfalz.com

"Prabhu" wrote:
Hi.
We have an ASP.net Web application in which some of the pages are to be
served over secure channel using HTTPS.
We have built a framework that allows pages to be served over secure channel
specified in a configuration file. When a request for specified pages comes
over HTTP, framework detects and redirects the browser over HTTPS.
Similarly for non secure pages if the request comes over HTTPS the
framework redirects the browser onto HTTP.

We use HttpRequest.IsS ecureConnection property to determine HTTP/HTTPS was
used to make the request. This all used to work fine until now.

Now the infrastructure group has taken out SSL responsibilitie s from the Web
Server and given it to an Hardware SSL offloader. What SSL offloader is doing
is it decrypts the request from client and sends an un encrypted request to
Web Server.
As a consequence HttpRequest.IsS ecureConnection is always returning false
to the application?

Is anyone aware of a solution to the above problem i.e. for us to detect SSL
request in SSL Offloading scenario by other means than using
HttpRequest.IsS ecureConnection (for e.g. checking headers??)

Thanks

Nov 19 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

10
4126
by: Frances Del Rio | last post by:
pls, why is this not working? <SCRIPT language=JavaScript type="text/javascript"> var br = '<SCRIPT language=Javascript' br += 'src="js_pop.js" type="text/javascript">' br += '</SCRIPT>' var op = '<SCRIPT language=Javascript' op += 'src="js_pop-op.js" type="text/javascript">' op += '</SCRIPT>' if (navigator.userAgent.indexOf('Opera') != -1 ) {
7
2355
by: fox | last post by:
Maybe this is not the best group to ask this question, but I don't know a better one. I'm looking for a *portable* program in C (I mean source code) to detect whether unaligned word access is: a. handled by the main processor (e.g. x86) b. not supported (e.g. Sparc running Solaris) c. emulated in software (e.g. Alpha running Linux) By "unaligned word access" I mean access to a 16-bit word
1
18364
by: Daniel Diehl | last post by:
Hi, I'm looking for a solution to detect if a USB Sticker (USB Drive) ist plugged in or plugged out. Currently Im able to detect Hardware Plugin and Plugout but don't get any information what type of device it is. Is there a way to get this information ? Currenty my solution work in that way (Also from this group): protected override void WndProc(ref Message m) { switch(m.Msg)
5
2177
by: Joe | last post by:
I have an application which runs in a non-secure environment. I also have an application that runs in a secure environment (both on the same machine). Is there any way to share the session data for this? Most of the site allows the user to add things to a cart (non-secure), once they choose to check-out, I need this information which was stored in the session to be read by the payment page(secured). Hope this makes sense. It's probably...
2
1915
by: Jeremy S. | last post by:
In an ASP.NET 1.1 Web application, how can I detect - with *reasonable* accuracy - whether any particular browser is a downlevel browser? My objective is to insert a different menu (different User Control containing a different menu) for downlevel vs uplevel browsers. This is very important as I have a great DHTML menu - but on many MACs, it doesn't work even though the vendor claims to cater to downlevel browsers. So I'm going to...
31
2403
by: Fredrik Tolf | last post by:
Hi List! I was thinking about secure Python code execution, and I'd really appreciate some comments from those who know Python better than I do. I was thinking that maybe it could be possible to load and run untrusted Python code, simply by loading it in a module with a modified version of __builtins__. Without any reachable function that do unsafe operations, code running from there shouldn't be able to do evil things.
3
4581
by: Raqueeb Hassan | last post by:
Hello, Given the idea of having voter ID card for all the citizens of Bangladesh, I was thinking of assessing few things before it actually starts. The election commission, the government agency responsible for issuing voter ID cards in Bangladesh might plan to use this - not only to hold a fair election but to facilitate its citizen to establish their credentials seeking access to all government and other commercial privileges - from...
1
2290
by: Przemek M. Zawada | last post by:
Dear Group, I have got two mice connected to one PC (notebook). In example I click parallel left button on mouse A and left button on mouse B. Is it possible, programmatically detect which on which mouse which button has been clicked? Mainly, the thing what I'm doing is to connect to 'scroll button click' a Halls sensor (contactron), one for each mouse, and I need to count down the sensor signals. The simplest way is to fetch the mouse
15
4235
by: RobG | last post by:
When using createEvent, an eventType parameter must be provided as an argument. This can be one of those specified in DOM 2 or 3 Events, or it might be a proprietary eventType. My problem is testing for support of particular eventTypes - the DOM 2 Events Interface DocumentEvent says that if the eventType is not supported, it throws a DOM exception. This makes testing rather tough - if you try something like: if (document &&...
0
9595
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
10604
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10354
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
10359
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
9177
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
5536
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5675
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
4314
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
3837
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.