SSL pages under ASP.NET MVC

Question

How do I go about using HTTPS for some of the pages in my ASP.NET MVC based site?

Steve Sanderson has a pretty good tutorial on how to do this in a DRY way on Preview 4 at:

http://blog.codeville.net/2008/08/05/adding-httpsssl-support-to-aspnet-mvc-routing/

Is there a better / updated way with Preview 5?,

Solution 1

If you are using ASP.NET MVC 2 Preview 2 or higher, you can now simply use:

[RequireHttps]
public ActionResult Login()
{
   return View();
}

Though, the order parameter is worth noting, as mentioned here.

Solution 2

MVCFutures has a 'RequireSSL' attribute.

(thanks Adam for pointing that out in your updated blogpost)

Just apply it to your action method, with 'Redirect=true' if you want an http:// request to automatically become https:// :

    [RequireSsl(Redirect = true)]

See also: ASP.NET MVC RequireHttps in Production Only

Solution 3

As Amadiere wrote, [RequireHttps] works great in MVC 2 for entering HTTPS. But if you only want to use HTTPS for some pages as you said, MVC 2 doesn't give you any love - once it switches a user to HTTPS they're stuck there until you manually redirect them.

The approach I used is to use another custom attribute, [ExitHttpsIfNotRequired]. When attached to a controller or action this will redirect to HTTP if:

1. The request was HTTPS
2. The [RequireHttps] attribute wasn't applied to the action (or controller)
3. The request was a GET (redirecting a POST would lead to all sorts of trouble).

It's a bit too big to post here, but you can see the code here plus some additional details.

Solution 4

Here's a recent post from Dan Wahlin on this:

http://weblogs.asp.net/dwahlin/archive/2009/08/25/requiring-ssl-for-asp-net-mvc-controllers.aspx

He uses an ActionFilter Attribute.

Solution 5

Some ActionLink extensions: http://www.squaredroot.com/post/2008/06/11/MVC-and-SSL.aspx Or an controller action attribute that redirects to https:// http://forums.asp.net/p/1260198/2358380.aspx#2358380

View more solutions

Comments

[RickAndMSFT]

This is very dated. For MVC4 and higher, see my blog post blogs.msdn.com/b/rickandy/archive/2012/03/23/…

[aruno]

make sure you see the follow post he wrote himself : blog.salvoz.com/2009/04/25/…

[royco]

This looks to be the best way at the moment.

[ArpitM]

Would I have to subclass it in order to handle localhost requests?

[aruno]

one way is to create a certificate for your local machine and use that. i think to completely disable it for localhost you would indeed need to subclass or duplicate the code. not sure what the recommended approach is

[ArpitM]

Looks like it's sealed so I'd need to dupe the code. Bummer. The certificate for the local machine would only work in IIS though right, not the dev web server.

[aruno]

@mr rogers - take a look at this : stackoverflow.com/questions/1639707/…

[heisenberg]

+1 a year later as the isLocal call helped me resolve an issue that was becoming a real pain in the @@@

[ashes999]

You can also do this on the controller level. Better yet, if you want the entire application to be SSL, you can create a base controller, extend it for all controllers, and apply the attribute there.

[GraemeMiller]

Alternatively you can add it is a global filter MVC3 in Global.asax GlobalFilters.Filters.Add(new RequireHttpsAttribute());

[Serj Sagan]

I think most people would disagree with you on this one, though providing an alternate way is always useful...

[RickAndMSFT]

No guaranteed other developers will use your derived controller. You can make one call to force HTTPS - see my blog post blogs.msdn.com/b/rickandy/archive/2012/03/23/…

[RickAndMSFT]

Updating this to MVC4+ see my blog post blogs.msdn.com/b/rickandy/archive/2012/03/23/…

[RickAndMSFT]

AllowAnonymous fixes that. For MVC4 and higher, see my blog post blogs.msdn.com/b/rickandy/archive/2012/03/23/…

[RickAndMSFT]

The above is dated, For MVC4 and higher, see my blog post blogs.msdn.com/b/rickandy/archive/2012/03/23/…