Ensure page is only accessed via SSL

Question

How do I ensure that my users can not physically type in http: to bypass my SSL and ensure that every page is https:?

Possibly a redirect on my master page?

Answer 1

if(!String.Equals(Request.Url.Scheme,
                  "https",
                  StringComparison.OrdinalIgnoreCase)) { }

Answer 2

This would generally be handled via IIS configuration or with an ISAPI filter, but if you want to do it in the application code, you could put something like this in the Page_Init event of your master page...

If Not Request.IsSecure
    Response.Redirect(Request.Url.AbsoluteUri.Replace("http://", "https://"))
End If

Answer 3

I would just redirect all http urls to https with a separate page, or use the "require secure channel" option on your IIS configuration, which will display an error if someone tries to access a non-https page.

Here's a site with a guide to redirecting the error page to the https URL of your site.

Answer 4

I've done this with an HTTPModule so that you don't have to worry about putting the code in every master page (if you have more than one). This version also turns off the redirect for localhost so you don't have to have SSL on your own machine. Basically you make a new HTTP module like this:

Public Class RedirectToHttpsModule
    Implements IHttpModule

    Public Sub Dispose() Implements IHttpModule.Dispose

    End Sub

    Public Sub Init(ByVal context As HttpApplication) Implements IHttpModule.Init
        AddHandler context.BeginRequest, AddressOf context_BeginRequest
    End Sub

    Private Sub context_BeginRequest(ByVal sender As Object, ByVal e As EventArgs)
        Dim application As HttpApplication = TryCast(sender, HttpApplication)
        If Not application.Request.IsSecureConnection And Not application.Request.IsLocal Then
             application.Response.Redirect(application.Request.Url.ToString().Replace(application.Request.Url.Scheme, "https"))
        End If
    End Sub

End Class

You also have to add the appropriate line in web.config for the HTTPModule:

<httpModules>
      <add type="RedirectToHttpsModule" name="RedirectToHttpsModule" />
</httpModules>

Answer 5

The following builds upon Josh Stodolas answer (IsSecureConnection) but uses the UriBuilder to change the scheme to https rather than a string replace. The benefit of this approach is that it won't change all the occurrences of "http" in the URL to "https".

if (!Request.IsSecureConnection)
{
    UriBuilder newUri = new UriBuilder(Request.Url);
    newUri.Scheme = Uri.UriSchemeHttps;
    Response.Redirect(newUri.Uri.AbsoluteUri);
}

Answer 6

If you want to accept only secure connections, create a separate service for port 80 that only redirects to HTTPS. Ideally, you would preserve the requested path in the HTTP redirect.

If you simply want to encourage HTTPS connections for browsing (and don't care about robots, e.g.), add this to your pages:

<script type="text/javascript">
if(location.protocol=='http:')
  location=location.toString().replace(/^http:/,'https:');
</script>