Hi,

I have read some articles regarding enabling SSL for website hosted in IIS6. I am not able to find the following info. Please anyone help me.

I have a website hosted in IIS 6. I want selected pages in that to be accessible thru ssl (https://). All other pages must be accessible only by http://.

I have successfully imported server certificate and checked specific pages as "Require SSL". But when an https page (say page1)is redirected to http page(page2), the latter(page2) is requested as https and not http. I have relative urls in all my links and server.transfers. so any transfer to non ssl page, thru relative url, from a ssl page is called as https.

Is there anyway to modify setting in IIS 6 so that http pages are not accessible by https requests. I tried writing a small piece of code in Application_BeginRequest() in global.asax.vb file.

End If

The above code did not work, as Request.IsSecureConnection is based on whether Request is http or https and not if the page is ssl enabled or not.

Please let me know how to switch easily. Should we change the code in APP?

Thanks in advance!!

You need to programatically do this on a page by page basis and you have things backwards for this I think, It should be like this for a non-secured page:

Response.Redirect(Request.Url.AbsoluteUri.Replace("https://", "http://"))

End If

I would setup a base method in a base page class to handle this for you too. This would keep things easier to maintain. 

You could also set up a custom httpModule to force redirects based on a custom configuration section or a list of pages in a database, etc.

First of all, a web site that jumps around between secure and non-secure pages can quickly become annoying, with constant warnings. And there's a risk the site will feel less secure, since it's jumping around.

A couple of pointers:

1. For Server.Transfer there's no solution. A Server.Transfer is performed in one single request context, and you can't switch to another url.

2. It would be quite easy to create a Redirect(string url,bool secure) method,  or similar, which could resolve the fully qualified url and prepend either http:// or https:// to it.

3. The suggestions from docluv are very good. You could create marker interfaces (interfaces without methods), e.g IRequiresSecureConnection and IRequiresNonSecureConnection, and let your pages implement them. A base page class works fine too. You can make the check in global.asax.