0

I have a website that requires some secure pages for logging in, user accounts, form submission etc. but does not need to be secure on most pages.

Certificate purchased and installed on www.mywebsite.com.

I am currently redirecting users to the https by using this C# code in the page_load:

    if (!Request.IsLocal && !Request.IsSecureConnection)
    {
        string redirectUrl = Request.Url.ToString().Replace("http:", "https:");
        Response.Redirect(redirectUrl);
    } 

My concern is that after visiting the secure page and the user clicks on another page, it stays secure rather than going back to http.

I have looked at a number of options including IIS rewrite (it's like a whole other language and too complicated) and coding something globally (redirects every page, not selective).

Is there a simple solution that will allow me to redirect to https on selected pages (about 10 or so pages, or all pages in a particular folder) and then back to http on all others? I'm not the greatest coder in the world, so trying to find something easy to implement and understand.

3
  • 2
    SSL across the board is the only safe bet. Partial SSL leaves open a whole range of attack vectors that across-the-board SSL closes. Why do you not want to use SSL across the board?
    – yfeldblum
    Oct 14, 2011 at 15:38
  • Why redirect back to http? Is https causing a problem? Security aside, it just seems like extra work to code this. Oct 14, 2011 at 15:38
  • Thanks. Sounds like it might be the way to go. Thought that because most of the site didn't need to be secure, it was better to limit SSL to data/login pages.
    – bjh
    Oct 18, 2011 at 18:13

2 Answers 2

0

If any portion of your website requires SSL, then I would strongly recommend that you use SSL throughout. You would be unnecessarily opening yourself up to potential data loss by doing anything else. Check out OWASP Top Ten for more info.

0

you can use HTTP Handlers to solve this issues instead of having the code on each page load

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.