Wahlin on .NET

Requiring SSL for MVC Controllers

ASP.NET MVC provides a lot of flexibility when it comes to changing how controllers, actions, routes and more work within an application. Having flexibility is good especially when you need to make a modification quickly without having to write a lot of code to get the change in place.

My company is in the process of rolling out an ASP.NET MVC site for a client and specific actions and controllers need to have SSL running to ensure that no sensitive information gets out, such as passwords and credit cards. If a user visits the site using http:// I need to switch them to https:// in certain parts of the Web site. Fortunately, ASP.NET MVC is quite extensible so it only took about four to five minutes to get a simple solution in place.

The easiest way I know of to switch to SSL for specific controllers or actions is to create an ActionFilterAttribute that handles redirecting them to an https:// address. Classes that derive from ActionFilterAttribute can be placed immediately above actions or even controllers in cases where the filter needs to apply to all actions in the controller. For my situation I needed entire controllers to be SSL-enabled so I placed the attribute above the controller class name.

Here's an example of the simple RequiresSSL attribute class:

using System;
using System.Web;
using System.Web.Mvc;

namespace Helpers
{
  public class RequiresSSL : ActionFilterAttribute
  {
    public override void OnActionExecuting(
     ActionExecutingContext filterContext)
    {
      HttpRequestBase req = filterContext.HttpContext.Request;
      HttpResponseBase res = filterContext.HttpContext.Response;

      //Check if we're secure or not and if we're on the local box
      if (!req.IsSecureConnection && !req.IsLocal)
      {
        string url = req.Url.ToString().ToLower()
         .Replace("http:", "https:");
        res.Redirect(url);
      }
      base.OnActionExecuting(filterContext);
    }
  }
}

Some may note that the ToLower() call shown previously could cause consequences with QueryString data. I could take ToString() out but some people may type "HTTP" instead of "http", which would mess up the replace call. For the current application I'm working on, I only have integers being passed around on the QueryString so it didn't affect me at all, but it definitely could affect string data being passed. The solution is to use the UriBuilder class, which works much better in this scenario. Here's a different version of the RequiresSSL class that uses the UriBuilder class to create the SSL redirect URL.

using System;
using System.Web;
using System.Web.Mvc;

namespace Helpers
{
  public class RequiresSSL : ActionFilterAttribute
  {
    public override void OnActionExecuting(
    ActionExecutingContext filterContext)
    {
      HttpRequestBase req = filterContext.HttpContext.Request;
      HttpResponseBase res = filterContext.HttpContext.Response;

      //Check if we're secure or not and if we're on the local box
      if (!req.IsSecureConnection && !req.IsLocal)
      {
        var builder = new UriBuilder(req.Url)
        {
          Scheme = Uri.UriSchemeHttps,
          Port = 443
        };
        res.Redirect(builder.Uri.ToString());
      }
      base.OnActionExecuting(filterContext);
    }
  }
}

The RequiresSSL attribute can then be placed above the appropriate action or controller:

 [HandleError]
[RequiresSSL]
public class AccountController : Controller
{
  ...
}

If you're running IIS7 and want to get a test SSL certificate setup for testing purposes, check out my good friend Rob Bagby's excellent post on the subject. He walks through the process of creating self-signed certificates and using them on your server.

About the Author

Dan Wahlin (Microsoft MVP for ASP.NET and XML Web Services) is the founder of The Wahlin Group which specializes in .NET and SharePoint onsite, online and video training and consulting solutions. Dan also founded the XML for ASP.NET Developers Web site, which focuses on using ASP.NET, XML, AJAX, Silverlight and Web Services in Microsoft's .NET platform. He's also on the INETA Speaker's Bureau and speaks at conferences and user groups around the world. Dan has written several books on .NET including "Professional Silverlight 2 for ASP.NET Developers," "Professional ASP.NET 3.5 AJAX, ASP.NET 2.0 MVP Hacks and Tips," and "XML for ASP.NET Developers." Read Dan's blog here.

comments powered by Disqus

Featured

  • Creating a Progressive Web App with Blazor WebAssembly

    Not surprisingly, it's dead easy to create an app in Blazor that runs outside of the browser window and (potentially) in an offline mode. Before you get carried away, though, there are some key design decisions to make.

  • GitLab Takes Over VS Code Extension, Plans Improvements

    DevOps specialist GitLab has officially taken over the control of a GitLab extension for Microsoft's open source, cross-platform Visual Studio Code editor.

  • VS Code Python Tool Now Does Native Notebooks

    The Python Extension for VS Code Insiders team is previewing the newest implementation of notebooks, used frequently in data science with offerings such as Jupyter Notebooks.

  • As .NET 5 Nears, Content/Documentation Reorganization Starts

    A GitHub project is seeking to reorganize documentation and developer content in advance of the November debut of .NET 5, a unification of all things .NET that combines. .NET Core and other components.

  • Windows Devs Get Cross-Platform Page, Issues Repo

    Developers doing their coding on the Windows OS have received two new resource gifts from Microsoft: a new landing page for those using cross-platform technologies and a new GitHub repo with which to report issues to Windows engineering teams.Developers doing their coding on the Windows OS have received two new resource gifts from Microsoft: a new landing page for those using cross-platform technologies and a new GitHub repo with which to report issues to Windows engineering teams.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events