Best Way in ASP.NET to Force Https for an Entire Site

Best way in asp.net to force https for an entire site?

Please use HSTS (HTTP Strict Transport Security)

from http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="HTTP to HTTPS redirect" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                        redirectType="Permanent" />
                </rule>
            </rules>
            <outboundRules>
                <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
                    <match serverVariable="RESPONSE_Strict_Transport_Security"
                        pattern=".*" />
                    <conditions>
                        <add input="{HTTPS}" pattern="on" ignoreCase="true" />
                    </conditions>
                    <action type="Rewrite" value="max-age=31536000" />
                </rule>
            </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>

Original Answer (replaced with the above on 4 December 2015)

basically

protected void Application_BeginRequest(Object sender, EventArgs e)
{
   if (HttpContext.Current.Request.IsSecureConnection.Equals(false) && HttpContext.Current.Request.IsLocal.Equals(false))
   {
    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
+   HttpContext.Current.Request.RawUrl);
   }
}

that would go in the global.asax.cs (or global.asax.vb)

i dont know of a way to specify it in the web.config

How do I force ASP.NET app to use HTTPS?

You'll need to detect if the request came in http or https, and redirect if http to https. The below post should have some hints

Best way in asp.net to force https for an entire site?

How to force HTTPS using a web.config file

You need URL Rewrite module, preferably v2 (I have no v1 installed, so cannot guarantee that it will work there, but it should).

Here is an example of such web.config -- it will force HTTPS for ALL resources (using 301 Permanent Redirect):

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <clear />
                <rule name="Redirect to https" stopProcessing="true">
                    <match url=".*" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" appendQueryString="false" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

P.S.
This particular solution has nothing to do with ASP.NET/PHP or any other technology as it's done using URL rewriting module only -- it is processed at one of the initial/lower levels -- before request gets to the point where your code gets executed.

How to force https for only the pages need to be authorized in a Asp.Net MVC 5 site?

Don't.

Your authentication cookie will be included with every request whether you need it or not. This means every request you serve over HTTP instead of HTTPS is vulnerable to session hijacking.

how to redirect from http to https in asp.net C# and make it as default version for the website

Are you looking for something like this:-

if (!Request.IsLocal && !Request.IsSecureConnection)
{
    string sUrl = Request.Url.ToString().Replace("http:", "https:");
    Response.Redirect(sUrl);
}

Also check this related forum.

From the above link:-

You can install URL Rewrite Module, create a redirect rule and put it to your web.config file

<rule name="http to https" stopProcessing="true">
     <match url=".*" />
     <conditions>
     <add input="{HTTPS}" pattern="off" />
     </conditions>
    <action type="Redirect" url="https://{HTTP_HOST}/{R:0}" />
 </rule>

Redirecting the whole site to HTTPS in ASP.net application

If you don't want to control it per IIS like Nate suggested, you can simply do the redirection in your global.asax:

void Application_BeginRequest(Object sender, EventArgs e)
{
    if (Request.Url.Scheme != "https")
        Response.Redirect("https://yoursite.com");
}

May not be the most witty solution, but it does the job.

Change website to https?

For automatically redirect http to https you can ask your webhost.Normaly they can do. Check this link for others methods

For hardcoded links: Replace 'http' or 'https' with '//', for example instead of http://yoursite.com/script.js use //yoursite.com/script.js .However I recommend to use relative path, if it's possible.

For Web control or server controls you can use Tilda "~" or Control.ResolveUrl. for example :

<asp:HyperLink NavigateUrl="~/views/view.aspx" runat="server" />

<a href="~/views/view.aspx" runat="server" >

<a href="<%= Page.ResolveUrl("~/views/view.aspx") %>"></a>

ASP.NET: best practice for redirecting to https

I'd use URL rewriting to do that. Why? because it's simple to implement, requires no modifications to the application, and is easy to maintain.

On IIS7 you can accomplish that using URL rewrite module, for example:

<!-- http:// to https:// rule -->
<rule name="ForceHttpsBilling" stopProcessing="true">
  <match url="(.*)billing/(.*)" ignoreCase="true" />
  <conditions>
    <add input="{HTTPS}" pattern="off" ignoreCase="false" />
  </conditions>
  <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}{REQUEST_URI}" />
</rule>

On IIS6 you'll have to use a 3rd party library. I use IIRF (http://www.codeplex.com/IIRF) it's free, stable, and has a good amount of features.

HTTPS for only one ASP.NET page (Login.aspx), HTTP always for rest of site

Try adding below in your Web.config

 <system.webServer>
<rewrite>
      <rules>
        <rule name="Redirect HTTP to HTTPS" stopProcessing="true">
          <match url="(Login.aspx)"/>
          <conditions>
            <add input="{HTTPS}" pattern="off" ignoreCase="true"/>
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Found"/>
        </rule>
      </rules>
    </rewrite>
  </system.webServer>

---

Related Topics