From the course: ASP.NET: Security

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Enforcing HTTPS

Enforcing HTTPS

From the course: ASP.NET: Security

Start my 1-month free trial

Enforcing HTTPS

“

- [Instructor] In this day and age, using HTTPS is a must. But how can we prevent that clients are using HTTP, that servers are using HTTP? There's several ways how we can enforce HTTPS, both specific to ASP.NET and generally. Let's have a look at a few of those. The first and probably most logical option is to redirect HTTP requests to HTTPS. A global handler can check HtttpContext.Current.Request.IsSecureConnection. If that returns false, we can just redirect to HTTPS. That's pretty efficient, but on the other hand, the clients are still sending HTTP requests, and they always get the results, because we redirect them to HTTPS, then they do the HTTPS request, everything is good, but maybe next time they try HTTP again. The second option is to use the rewriting features in ASP.NET, specifically in web.config. When we use IIS, we have the system.webServer node in web config, and then we can set rewrite rules, and those rewrite rules we can check for HTTP requests and then, well…

Contents