HTTPS: Security within an ASP.NET application

Question

Is there any way to require certain pages within a single ASP.NET application to require HTTPS access?????

classy_catlady · Answer

Hi I am working on the same issue at work now as we speak if you e-mail me I can e-mail you back a class library that I created. My e-mail address is:classy_catlady@yahoo.com

david 0 · Answer

ICQ 161923043 Basically it is a client requirement...He wants to see the "You are about to enter/leave a secure site" messages......

katana · Answer

CPUWizard, why not have the whole application run on HTTPS ? Is there a problem w/ that? Give me a messenger, AIM, ICQ or something and I'll discuss it with you. Morgan

david 0 · Answer

Based on discussions at last nights DotNetDev meeting, this looks like one of the few possible solutions. Non trivial since it requires streaming out and in a potentially complex set of objects each with relationships.....

shan_1210 · Answer

How about storing session externally in a SQL server? I guess that shuld preserve your session information ..

david 0 · Answer

Hello, Thank you for your response, are you available via ICQ,MSN,AOL or Yahoo? I have reduced the problem to a VERY minimal remaining issue. The certificate is properly installed, IIS is configured and Secure Web pages are working. The remaining issue is switching between HTTP and HTTPS for different pages (I have flagged the desired pages in IIS to prevent viewing by HTTP). If I have ReDirect("SomePage.aspx") in my code then it will stay with whatever protocol is currently active. If I put the full path name with the HTTP or HTTPS in, it DOES switch protocols, but I loose some of my session related information since the page reference is absolute. This also causes major problems with portability. Ideally it would be nice if the app could "know" how the page is marked in IIS and use the appropriate protocol. Failing to achieve that that having a "secure" parameter on the re-direct [boolean] would be acceptable....

shan_1210 · Answer

Did you apply and get a certificate from one of the certification authority? Assuming you did, I have never tried this...but a suggestion is, Open the IIS Manager and go the specific page.Right Click-->Properties Go to File Security Tab. The Secure Communications options should have been enabled if you have the certificate installed. Click on Edit and Check the Require SSL check box ! This will force you to use https rather than http. HTH

david 0 · Answer

Thanks for the reply. Unfortunately even after I do that when I re-direct to the page it still shows as: http://www.mysite.com/application.page.aspx rather than https://www.mysite.com/application.page.aspx

thed0ct0r · Answer

modify the Web.config file like this: Then build Login.aspx

HTTPS: Security within an ASP.NET application

Answers (9)