asp.net - Enforcing SSL connection -
a) Can you apply SSL connection to server side (selection ) Only a safe channel option is required per web app, or can you apply it to a virtual directory or only per web page?
B) How does SSL implementation work? If users specify http instead of https protocol (in the requested URL), will the request be rejected by IIS?
thanx
as explained above 1) SSL can be set on server, side or virtual directory.
2) If the server / site / vdir is configured using the "Require Secure Channel" setting, then the response from the server "403.4 is forbidden: SSL needs to view this resource." Error or "403.5 Forbidden: SSL 128 is required to view this resource."
You can actually customize 403.4 or 403.5 errors to redirect back to HTTPS. Create a VideoDir under your site with any SSL requirement ( ** This is important ) - I use "custom error" in this directory called 403_4_Error.asp Create an ASP file inside this directory:
& lt;% @ LANGUAGE = "VBScript"% & gt; & Lt;% If requested. White ("HTTPS") & lt; & Gt; "On" then sServer = Request.ServerVariables ("SERVER_NAME") sScript = Request.ServerVariables ("SCRIPT_NAME") sql = Request.ServerVariables ("QUERY_STRING") response Type ("https: //" & sServer & amp; sScript & Amp; "?" & Amp; sQuery) if% & gt; Edit the custom error property of Server / Site / vdir for 403.4 / 403.5 and type the message on the URL and URL on "/CustomError/403_4_Error.asp" P> Note that ASP is used, you can easily use ASP.NET or any other scripting language.
Comments
Post a Comment