HTTPS: Security within an ASP.NET application

Hi I am working on the same issue at work now as we speak if you e-mail me I can e-mail you back a class library that I created. My e-mail address is:[email protected]

ICQ 161923043 Basically it is a client requirement...He wants to see the "You are about to enter/leave a secure site" messages......

CPUWizard, why not have the whole application run on HTTPS ? Is there a problem w/ that? Give me a messenger, AIM, ICQ or something and I'll discuss it with you. Morgan

Based on discussions at last nights DotNetDev meeting, this looks like one of the few possible solutions. Non trivial since it requires streaming out and in a potentially complex set of objects each with relationships.....

How about storing session externally in a SQL server? I guess that shuld preserve your session information ..

Hello, Thank you for your response, are you available via ICQ,MSN,AOL or Yahoo? I have reduced the problem to a VERY minimal remaining issue. The certificate is properly installed, IIS is configured and Secure Web pages are working. The remaining issue is switching between HTTP and HTTPS for different pages (I have flagged the desired pages in IIS to prevent viewing by HTTP). If I have ReDirect("SomePage.aspx") in my code then it will stay with whatever protocol is currently active. If I put the full path name with the HTTP or HTTPS in, it DOES switch protocols, but I loose some of my session related information since the page reference is absolute. This also causes major problems with portability. Ideally it would be nice if the app could "know" how the page is marked in IIS and use the appropriate protocol. Failing to achieve that that having a "secure" parameter on the re-direct [boolean] would be acceptable....

Did you apply and get a certificate from one of the certification authority? Assuming you did, I have never tried this...but a suggestion is, Open the IIS Manager and go the specific page.Right Click-->Properties Go to File Security Tab. The Secure Communications options should have been enabled if you have the certificate installed. Click on Edit and Check the Require SSL check box ! This will force you to use https rather than http. HTH

Thanks for the reply. Unfortunately even after I do that when I re-direct to the page it still shows as: http://www.mysite.com/application.page.aspx rather than https://www.mysite.com/application.page.aspx