Ensure page is only accessed via SSL

[- Steve -]

If a user where to go to http://server/page.aspx I want to force them over
to https://server/page.aspx. So those that didn't catch the subtle hint
there, I want to move them over to the SSL page.

What's the best way to handle that? I know I can have IIS block access to a
page if it's not over HTTPS, but I just want to seamlessly move them to the
HTTPS space.

I was thinking I could Response.Redirect() on the page load, but that just
doesn't seem right.

--

Steve Evans
Email Services
SDSU Foundation
[phone]

[- Steve -]

I'll answer my own question

In Page_load

Response.Buffer = true;

if(Request.ServerVariables["HTTPS"].Equals("off"))

{

String redirect = "", queryString = "";

redirect = "https://" + Request.ServerVariables["SERVER_NAME"] +

Request.ServerVariables["SCRIPT_NAME"];

queryString = Request.ServerVariables["QUERY_STRING"];

if(!queryString.Equals(""))

redirect += "?" + queryString;

Response.Redirect(redirect);

}

To reverse that (go from https to http) just switch the first if statment to
on, and assign redirect to http instead of https
--

Steve Evans
Email Services
SDSU Foundation
[phone]
"- Steve -" <se****@foundation.sdsu.edu> wrote in message
news:u5*************@tk2msftngp13.phx.gbl...

If a user where to go to http://server/page.aspx I want to force them over
to https://server/page.aspx. So those that didn't catch the subtle hint
there, I want to move them over to the SSL page.

What's the best way to handle that? I know I can have IIS block access to
a page if it's not over HTTPS, but I just want to seamlessly move them to
the HTTPS space.

I was thinking I could Response.Redirect() on the page load, but that just
doesn't seem right.

--

Steve Evans
Email Services
SDSU Foundation
[phone]

[Joerg Jooss]

- Steve - wrote:

I'll answer my own question

In Page_load

Response.Buffer = true;

if(Request.ServerVariables["HTTPS"].Equals("off"))

{

String redirect = "", queryString = "";

redirect = "https://" + Request.ServerVariables["SERVER_NAME"] +

Request.ServerVariables["SCRIPT_NAME"];

queryString = Request.ServerVariables["QUERY_STRING"];

if(!queryString.Equals(""))

redirect += "?" + queryString;

Response.Redirect(redirect);

}

Testing ServerVariables seems a little ASPish -- better to use properties:

if (Request.IsSecureConnection()) {
// ...
queryString = Request.QueryString;
}

Also, in a more real-world scenario, load balancers or application level
firewalls should enforce such access rules (though redundant security
features won't hurt ;->).

--
Joerg Jooss
jo*********@gmx.net

[ashelley]

On Thu, 1 Jul 2004 15:26:27 -0700, "- Steve -"
<se****@foundation.sdsu.edu> wrote:

I'll answer my own question

In Page_load

Response.Buffer = true;

if(Request.ServerVariables["HTTPS"].Equals("off"))

{

String redirect = "", queryString = "";

redirect = "https://" + Request.ServerVariables["SERVER_NAME"] +

Request.ServerVariables["SCRIPT_NAME"];

queryString = Request.ServerVariables["QUERY_STRING"];

if(!queryString.Equals(""))

redirect += "?" + queryString;

Response.Redirect(redirect);

}

To reverse that (go from https to http) just switch the first if statment to
on, and assign redirect to http instead of https

you can install the rsa ace client for IIS and it has an option for
force https. http://www.rsasecurity.com

-Adam