HTTP stands for HyperText Transport Protocol, which is just a fancy way of saying it's a protocol (a language, in a manner of speaking) for information to be passed back and forth between web servers and clients.
You really don't need to know what it all stands for; the important thing is the letter S which makes the difference between HTTP and HTTPS. The S (big surprise) stands for "Secure". You probably didn't need me to tell you that, because you already knew it had something to do with security.
If you visit a website or webpage, and look at the address in the web browser, it will likely begin with the following: http://. This means that the website is talking to your browser using the regular 'unsecure' language. In other words, it is possible for someone to "eavesdrop" on your computer's conversation with the website. If you fill out a form on the website, someone might see the information you send to that site. But if the web address begins with https://, that basically means your computer is talking to the website in a secure code that no one can eavesdrop on.
You understand why this is so important, right? If a website ever asks you to enter your credit card information, you should automatically look to see if the web address begins with https://. If it doesn't, there's no way you're going to enter sensitive information like a credit card number
Add the following code in "Init" method
// register for the BeginRequest event application.BeginRequest += new EventHandler(OnBeginRequest); application.EndRequest += new EventHandler(OnEndRequest);
Add the following method to implement "BeginRequest" event
//BeginRequest implementation
public void OnBeginRequest(Object sender, EventArgs e) {
HttpApplication app = (HttpApplication)sender;
string HttpUrl = app.Request.Url.ToString();
if (HttpUrl.StartsWith("http:"))
//Redirection done only if URL starts with http:
{
HttpUrl = HttpUrl.Replace("http:", "https:");
app.Response.Redirect(HttpUrl.ToString(), true);
//Redirecting (http 302) to the same URL but with https
app.Response.End();
//We don't want to any further so end }
}
Add the following method to implement "BeginRequest" event
//BeginRequest implementation
public void OnBeginRequest(Object sender, EventArgs e) {
HttpApplication app = (HttpApplication)sender;
string HttpUrl = app.Request.Url.ToString();
if (HttpUrl.StartsWith("http:"))
//Redirection done only if URL starts with http:
{ HttpUrl = HttpUrl.Replace("http:", "https:");
app.Response.Redirect(HttpUrl.ToString(), true);
//Redirecting (http 302) to the same URL but with https
app.Response.End();
//We don't want to any further so end
}
}
Add the following method to implement "OnEndRequest" event
//This is for scenario where SSL is forced on the site
public void OnEndRequest(Object sender, EventArgs e) {
HttpApplication app = (HttpApplication)sender;
if (app.Response.StatusCode == 403 && app.Response.SubStatusCode == 4) {
string HttpUrl = app.Request.Url.ToString();
if (HttpUrl.StartsWith("http:")) {
HttpUrl = HttpUrl.Replace("http:", "https:");
app.Response.Redirect(HttpUrl.ToString(), true);
app.Response.End(); } }
Make sure you have the following in your web.config inside configuration tag
<system.webServer> <modules> <add name="redir" type="http2https.redir" /> </modules> </system.webServer>
Comments
Post a Comment