SolutionMania

Automatically switching to SSL in ASP.NET

At first, it seems like quite a simple requirement - to automatically transfer a visitor to an SSL connection when they visit a certain area of our site (everything in the 'secure' folder in our case), and to transfer them back to a plain old HTTP connection when they leave.

Our initial implementation of this was a simple HTTP Module. This intercepted incoming HTTP requests for the '/secure/' folder and redirected the user to an HTTPS version of the same page. Conversely, if an HTTPS request comes in for a page which isn't in the '/secure/' folder, a redirect is issued to the HTTP version.

This appeared to work fine for quite a while. But - we started to have some problems with the release of IE8 and recent releases of Firefox. On visiting the site, it would appear that requests for WebResource.axd were still being issued over HTTP rather than HTTPS. This meant that our users started getting warning messages pointing out that some parts of the page were not being delivered securely.