Ensure page is only accessed via SSL

Question

How do I ensure that my users can not physically type in http: to bypass my SSL and ensure that every page is https:?

Possibly a redirect on my master page?

Answer 1

This would generally be handled via IIS configuration or with an ISAPI filter, but if you want to do it in the application code, you could put something like this in the Page_Init event of your master page...

If Not Request.IsSecure
    Response.Redirect(Request.Url.AbsoluteUri.Replace("http://", "https://"))
End If

Answer 2

I would just redirect all http urls to https with a separate page, or use the "require secure channel" option on your IIS configuration, which will display an error if someone tries to access a non-https page.

Here's a site with a guide to redirecting the error page to the https URL of your site.

Answer 3

The following builds upon Josh Stodolas answer (IsSecureConnection) but uses the UriBuilder to change the scheme to https rather than a string replace. The benefit of this approach is that it won't change all the occurrences of "http" in the URL to "https".

if (!Request.IsSecureConnection)
{
    UriBuilder newUri = new UriBuilder(Request.Url);
    newUri.Scheme = Uri.UriSchemeHttps;
    Response.Redirect(newUri.Uri.AbsoluteUri);
}