ASP.Net (C#) How to POST to HTTPS from an HTTP page

Question

C# 3.0 ASP.Net 2.0 IIS6

I have a regular [non-https] page. There is the standard one ASP.Net form on the page.

There are two "areas" of functionality on the page though. Login and "Get Quote". The login page needs to POST to HTTPS while the rest of the page [including the "other area"] form can't be HTTPS. In Java [JSP] and regular Html, we would just have two forms. One that posts to HTTPS and one that doesn't.

What is the way to handle this in ASP.Net [from one page]. I know that I could link to an HTTPS login.aspx page, but the business really would like the context together.

Any ideas?

Thanks,

Answer 1

The solution is to use asp.net to specify a "cross page postback", that is, you user the PostBackUrl property of any button control (LinkButton, Button, ImageButton etc.). This property allows you to post back to any page you like. Just set your PostBackUrl to the https version of your page and you're good to go (also make sure there are no url redirects active which force http on your page).

// ensure we send credentials over a secure connection
if (!HttpContext.Current.Request.IsSecureConnection)
{
     string postbackUrl = HttpContext.Current.Request.Url.AbsoluteUri.Replace("http", "https");
     LinkButton_Login.PostBackUrl = postbackUrl;
}

In your specific case you should set one of your buttons to post back to the https version, and the other to the http version (if you don't specify the PostBackUrl the default is to post back to the page itself as is).

Answer 2

You can have two forms on an aspx page. You just can't nest them.

On a page I built, I have one form that posts back to the page, and one that posts back to Google Checkout.

If you have to mix the contents of the page, put the https form at the bottom of the page (after the main form tag) and fill it with hidden fields. When the user clicks a button, use Javascript to assign values to the hidden fields and then post the https form.