Using HttpModules to perform a SSL switch on web pages

  • Article

A common requirement of any secure website is to make sure that when a user traverses to a "sensitive" part of the website such the login page, the password reset page or even the personal profile page which might contain contact detail you would want the user to be forced onto a HTTPS secured page.

On the other hand, you might also want the user to be forced off the Secure protocol for general view pages so that the network bottleneck is eliminated at the server end due to unwanted overuse of HTTPS. One of the best ways to achieve this is using HttpModules in ASP.NET which provides a very powerful mechanism to intercept HTTP requests and redirect them as necessary.

To effectively develop HttpModule you need to

1. Hook up the module during the OnInit event

2. Trap the request during the PreRequestHandler event.

Digging into the code, it would be something like this:

 public class SslSwitchModule : IHttpModule    {        //store your secure pages in a hastable for fast retrieval.        //this can be populated when the application starts up so that repeated         // overhead is avoided.        private static Hashtable securePages = null;                        public void ProcessRequest(HttpContext context)        {            Uri requestUri = context.Request.Url;            //if the request is for HTTP, check if HTTPS is needed            if (!context.Request.IsSecureConnection)            {                string urlRequested = HttpUtility.UrlDecode(context.Request.Path.ToUpper().Replace(context.Request.ApplicationPath.ToUpper(),""));                if (SecurePages.ContainsValue(urlRequested))                {                    //switch to HTTPS                    string secureUrl = "https" + context.Request.Url.AbsoluteUri.Substring(4);                    context.Response.Redirect(secureUrl, true);                }            }            else            {                //if the url requested is inside the https,                // determine if its needed to be in that page                string urlRequested = HttpUtility.UrlDecode(context.Request.Path.ToUpper().Replace(context.Request.ApplicationPath.ToUpper(), ""));                if (!SecurePages.ContainsValue(urlRequested))                {                    //switch to HTTPS                    string unSecureUrl = "http" + context.Request.Url.AbsoluteUri.Substring(5);                    context.Response.Redirect(unSecureUrl, true);                }            }           }                      #region IHttpModule Members        public void Dispose()        {            ;        }        public void Init(HttpApplication context)        {                // wireup the event for processing             context.PreRequestHandlerExecute += new EventHandler(context_PreRequestHandlerExecute);                    }        void context_PreRequestHandlerExecute(object sender, EventArgs e)        {            HttpApplication httpApp = (HttpApplication)sender;            //process the request            this.ProcessRequest(httpApp.Context);        }               #endregion    }

Comments

  • Anonymous
    September 04, 2008
    PingBack from http://www.easycoded.com/using-httpmodules-to-perform-a-ssl-switch-on-web-pages/

  • Anonymous
    September 05, 2008
    What would be the impact on the postback requests? will there be any data loss?

  • Anonymous
    September 05, 2008
    Thanks for the insight into this, handy code snippit!

  • Anonymous
    September 08, 2008
    For the query "What would be the impact on the postback requests? will there be any data loss?", the answer is it depends! If you are doing a postback with the appropriate protocol included (for e.g. to a HTTPS page which requires it) then there would not be any data loss, but if you are doing a postback to a page which requires SECURE but the target of the postback URL has been mentioned as http, then there would be a loss.