Is there a way to ensure that an ASP.NET application is (only) running on the HTTPS protocol?

Question

I'm wondering if there is a way to ensure that an ASP.NET application can only be run using the HTTPS protocol

I'm fine with any code (defensive programming measure perhaps?) that can do the trick, or possibly some IIS/web server setting that can get the job done.

Answer 1

IIS will definitely allow you to require HTTPS. The instructions are here.

Edit: I had to go dig for it, but there's also Request.IsSecureConnection for defensive programming.

Answer 2

The only problem with enforcing the SSL on the IIS level is that the user receives an ugly 403.4 page error

"The page must be viewed over a secure channel"

To make the transition seamless, you could redirect the user to the secure site using the Request.IsSecureConnection if they do not generate the request over SSL.

Answer 3

There is a nice article that has some good information and a helper utility class on this subject over at leastprivilege.com