asp.net中强制https用于整个网站的最佳方式？

大约6个月前,我推出了一个网站,每个请求都需要通过https.当我找到确保页面的每个请求都通过https的唯一方法是在页面加载事件中检查它.如果请求不是通过http,我会response.redirect(" https://example.com ")

有没有更好的方法 - 理想情况下web.config中的一些设置？

请使用HSTS

来自http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx

原始答案(2015年12月4日替换为上述内容)

基本上

protected void Application_BeginRequest(Object sender, EventArgs e)
{
   if (HttpContext.Current.Request.IsSecureConnection.Equals(false) && HttpContext.Current.Request.IsLocal.Equals(false))
   {
    Response.Redirect("https://" + Request.ServerVariables["HTTP_HOST"]
+   HttpContext.Current.Request.RawUrl);
   }
}

那将放在global.asax.cs(或global.asax.vb)中

我不知道在web.config中指定它的方法

您可以做的另一件事是通过将"Strict-Transport-Security"标头返回到浏览器来使用HSTS.浏览器必须支持这一点(目前,它主要是Chrome和Firefox),但这意味着一旦设置,浏览器就不会通过HTTP向网站发出请求,而是在发出请求之前将它们转换为HTTPS请求.尝试与HTTP中的重定向结合使用:

protected void Application_BeginRequest(Object sender, EventArgs e)
{
  switch (Request.Url.Scheme)
  {
    case "https":
      Response.AddHeader("Strict-Transport-Security", "max-age=300");
      break;
    case "http":
      var path = "https://" + Request.Url.Host + Request.Url.PathAndQuery;
      Response.Status = "301 Moved Permanently";
      Response.AddHeader("Location", path);
      break;
  }
}

不支持HSTS的浏览器只会忽略标头,但仍会被switch语句捕获并发送到HTTPS.

IIS7模块将允许您重定向.

GlobalFilters.Filters.Add(new RequireHttpsAttribute());

AntiForgeryConfig.RequireSsl = true;

// app is your OWIN IAppBuilder app in Startup.cs
app.UseHsts(options => options.MaxAge(days: 30).Preload());

// app is your OWIN IAppBuilder app in Startup.cs
app.UseHpkp(options => options
    .Sha256Pins(
        "Base64 encoded SHA-256 hash of your first certificate e.g. cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=",
        "Base64 encoded SHA-256 hash of your second backup certificate e.g. M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=")
    .MaxAge(days: 30));

using System;
using System.Web;

namespace HttpsOnly
{
    /// 

    /// Redirects the Request to HTTPS if it comes in on an insecure channel.
    /// 
    public class HttpsOnlyModule : IHttpModule
    {
        public void Init(HttpApplication app)
        {
            // Note we cannot trust IsSecureConnection when 
            // in a webfarm, because usually only the load balancer 
            // will come in on a secure port the request will be then 
            // internally redirected to local machine on a specified port.

            // Move this to a config file, if your behind a farm, 
            // set this to the local port used internally.
            int specialPort = 443;

            if (!app.Context.Request.IsSecureConnection 
               || app.Context.Request.Url.Port != specialPort)
            {
               app.Context.Response.Redirect("https://" 
                  + app.Context.Request.ServerVariables["HTTP_HOST"] 
                  + app.Context.Request.RawUrl);    
            }
        }

        public void Dispose()
        {
            // Needed for IHttpModule
        }
    }
}