IIS HTTP to HTTPS redirect not working behind AWS ELB

261 Views Asked by At

I am trying to achieve the following scenario.

Environment: Windows Server 2012 / IIS 8 / .Net Web Application

  • Visitors arrive on an HTTP landing page (customer wants HTTP, not HTTPS for landing page).
  • They enter details on the landing page, submit and are sent to a billing page.
  • When sending to the billing page, the code checks if the landing page is currently HTTP/S.
  • If landing page is currently HTTP, the session should be changed to HTTPS. If already HTTPS, no change required.

This works as expected when IIS is not behind an AWS ELB (i.e. traffic sent direct to IIS).

When in a load balanced configuration, i.e. 2 servers behind an ELB, the redirect does not occur, so a visitor hitting the landing page on HTTP is not redirected to HTTPS. They could then enter card details unsecured if they are not paying attention.

The code that checks and perform the HTTP->HTTPS is as follows:

protected virtual void RedirectToBillingPage()
    {
        string urlScheme = "http";
        bool isHTTPS = RedirectToSecure;
        string billingHost = WebConfigurationManager.AppSettings["BillingHost"];
        if (string.IsNullOrEmpty(billingHost) && (string.Equals("https", Request.Url.Scheme) || !isHTTPS))
        {
            Response.Redirect(string.Format("Billing.aspx?aff={0}&sub={1}&cid={2}{3}{4}",
                AffiliateData.Affiliate, AffiliateData.SubAffiliate, AffiliateData.ClickID, 
                !string.IsNullOrEmpty(CouponCode) ? "&cpn=" + CouponCode : "",
                !string.IsNullOrEmpty(Request["exit"]) ? "&exit=" + Request["exit"] : ""));
            return;
        }

        string encryptedData = string.Empty;
        if (isHTTPS) urlScheme = "https";
        if (isHTTPS || !string.IsNullOrEmpty(billingHost))
        {
            var s = new UrlStorage();
            BackupSessionAndCookie(s);
            encryptedData = HttpUtility.UrlEncode(s.EncyptToString());
        }
        string path = null;
        try
        {
            path = string.Format("{0}://{1}?{2}"
                    , urlScheme
                    , !string.IsNullOrEmpty(billingHost) ? billingHost + (!billingHost.EndsWith("/") ? "/" : "") + "Billing.aspx"
                    : Request.Url.Authority + Request.Url.AbsolutePath.ToLower().Replace("landing.aspx", "billing.aspx")
                    , (encryptedData != string.Empty ? "dta=" + encryptedData + "&" : "") +
                    "aff=" + AffiliateData.Affiliate + "&sub=" + AffiliateData.SubAffiliate + "&cid=" + AffiliateData.ClickID +
                    (!string.IsNullOrEmpty(CouponCode) ? "&cpn=" + CouponCode : "") +
                    (!string.IsNullOrEmpty(Request["exit"]) ? "&exit=" + Request["exit"] : ""));

        }
        catch { }
        if (!string.IsNullOrEmpty(path)) Response.Redirect(path);
    }

Any insight into why this is failing?

I should add that IIS is also configured for both HTTP/S between the ELB and IIS.

0

There are 0 best solutions below