HTTP to HTTPS Browser issue

Question

I been searching about this issue about a couple of days and done pretty much research but I just can't figure this out.

I'm trying to control my pages to redirect them to http or https whatever I need it or not.

I created an attrubte to put above every page which I need to run in HTTPS

[AttributeUsage(AttributeTargets.Class)]
public sealed class RequireSSL : Attribute { }

Then I have a HttpModule running to check every page on request.

public class DartsGhentPipeline : IHttpModule
    {
        public void Init(HttpApplication context)
        {
            context.PreRequestHandlerExecute += Context_PreRequestHandlerExecute;
        }

        private void Context_PreRequestHandlerExecute(object sender, EventArgs e)
        {
            HttpApplication application = (HttpApplication)sender;
            HttpRequest request = application.Request;
            HttpResponse response = application.Response;
            Page page = application.Context.CurrentHandler as Page;

            if (page == null)
                return;

            bool requireSSL = page.GetType().GetCustomAttributes(typeof(RequireSSL), true).Length > 0;
            bool isSecureConnection = request.IsSecureConnection;
            string url = string.Format("{0}://www.dartsghent.be{1}", requireSSL ? Uri.UriSchemeHttps : Uri.UriSchemeHttp, HttpContext.Current.Request.RawUrl);

            if (requireSSL != isSecureConnection)
                response.RedirectPermanent(url);
        }

        public void Dispose() { }
    }

Problem here is, when I redirect to the same url or any other. The browser refuses to switch from http to https or the other way around which result in a redirect loop and the browser will prevent this from happening.

I have found my website would run perfectly when I alternate my url with www. or without the www. but I can't use this on subwebsite where I have test.dartsghent.be

can anyone tell my how I can fix this and please without the urlrewriter module pls.

any help is appreciated

Note: I'm not using MVC

Here is en example of Chrome output.

As you can see the page keeps redirecting itself. I'm using the RedirectPermanent(url) to https but even tho the redirect gets triggered its not moving to https so it keeps trying.

Answer 1

I did more research and found the problem is in my redirect function. when you redirect to the same domain then it won't change the protocol. so what I did is to check the domain if www. is in front it or not and then redirect to the domain with the www. in front of it there isn't one.

Incase of a subdomain this would be harder so I would have to redirect to another page first. else the browser ends up in a loop.

seems a bit drastic for me but its the only way I get it to work.

Answer 2

Assuming this is ASP.NET MVC...

This functionality already exists in MVC v4 via the System.Web.Mvc.RequireHttpsAttribute class.

Answer 3

You are hard-coding www.blah... for your url variable.

If you want to use sub-domains you need to interrogate the original request:

string url = requireSSL ? Uri.UriSchemeHttps : Uri.UriSchemeHttp +
             request.Host +
             request.AbsolutePath +
             request.Query;

This is off the top of my head. Inspect the resulting string and adjust accordingly.