2

I'm working on a web site which contains sections that need to be secured by SSL.

I have the site configured so that it runs fine when it's always in SSL, I see the SSL padlock in IE7/IE8/FireFox/Safari/Chrome

To implement the SSL switching, I created a class that implemented IHTTPModule and wired up HTTPApplication.PreRequestHandlerExecute.

I go through some custom logic to determine whether or not my request should use SSL, and then I redirect. I have to deal with two scenarios:

  • Currently in SSL and request doesn't require SSL
  • Currently not in SSL but request requires SSL

I end up doing the followng (where ctx is HttpContext.Current and pathAndQuery is ctx.Request.Url.PathAndQuery)

// SSL required and current connection is not SSL
if (requestRequiresSSL & !ctx.Request.IsSecureConnection)
   ctx.Response.Redirect("https://www.myurl.com" + pathAndQuery);
// SSL not required but current connection is SSL
if (!requestRequiresSSL & ctx.Request.IsSecureConnection)
   ctx.Response.Redirect("http://www.myurl.com" + pathAndQuery);

The switching back and forth now works fine. However, when I go into SSL mode, FireFox and IE8 warns me that my request isn't entirely encrypted.

It looks like my module is short circuiting my request somehow, would appreciate any thoughts.

2
  • What is exact warning that IE8 and FF give you? Mar 5, 2009 at 22:23
  • FireFox tells me that my connection is partially encrypted, "parts of the page you are viewing were not encrypted before being transmitted over the internet" Interestingly, Fiddler only shows HTTPS requests Mar 5, 2009 at 22:27

6 Answers 6

4

I would suspect, that when you determine which resources require encryption, and which not, you do not include the images, or some header and footers as well, or even CSS files, if you use any.

As you always throw away SSL for such a content, it may happen that part of the page (main html) requires SSL, but the consequential request for an image on this page does not.

The browser is warning you, that some parts of the page were not delivered using SSL.

I will check if the request is for HTML, and only then drop the SSL if needed. Otherwise, keep it the way it is (most probably images and such are referenced with relative paths, than a full blown url).

I.e., if you have:

<html>
<body>
   Some content...
   <img src="images/someimage.jpg">
</body>
</html>

and you request this page using SSL, but your evaluation of requestRequiresSSL does not take into account the images as secured resources, it will form a http, not https request, and you will see the warning.

Make sure when you request a resource and evaluate requestRequiresSSL, to check the referrer and if this is an image:

// SSL not required but current connection is SSL
if (!requestRequiresSSL && ctx.Request.IsSecureConnection && !isHtmlContent)
   ctx.Response.Redirect("http://www.myurl.com" + pathAndQuery);

Just figure out how to determine isHtmlContent (if you do not serve images from a database, etc., but from a disk location), just check the the resource filename (.aspx, .asmx, .ashx, .html, etc.).

That way, if the connection is encrypted, but the resource itself is not html, and no set for "encryption", you are not going to drop the encryption.

0
1

I highly recommend using this (free / open source) component to do what you're trying:

http://www.codeproject.com/KB/web-security/WebPageSecurity_v2.aspx

0
0

Any content that is not normally handled by .Net (such as regular html and most graphic files) will not execute the httpmodule because it doesn't go through .net

Your best bet is to just handle this at the IIS level. See the following for info on how to configure your server.

http://www.jameskovacs.com/blog/HowToAutoRedirectToASSLsecuredSiteInIIS.aspx

1
  • Chris, the only issue here is that this is a CMS where content authors can create sites and set a "RequireSSL" property on them. The sites are stored in the CMS database but not in IIS. Mar 6, 2009 at 4:03
0

I highly recommend you this product:

http://www.e2xpert.com/web/Http-Https-Switch.aspx

It is professional and easy to use. It comes with a powerful configuration tool, by which just one click can finish the entire configuration for you.

0

Just use SSL throughout your site, for all pages and for all images/scripts/stylesheets. That just makes everything oh-so-simple. IE and Firefox will no longer complain, you will no longer have crazy modules trying to guess whether any given request should be redirected, etc.

0

For the average user it's nearly impossible for them to make a informed decision when the only thing Firefox vaguely tells them is, "Parts of the page you are viewing were not encrypted before being transmitted over the Internet." This is about as helpful as the "somethings wrong" engine light and in fact is telling them after their information has been transferred.

The least this message should be accompanied with is a list providing the URL, type of content (images, javascript, css) and what it means to the user. BTW I get this message when using GMail.

Until that happens, as others stated your code should work once you determine the unsecured elements. Then you can use Firebug (http://getfirebug.com) to check the content being delivered over the connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.