Question

Can you have one page in a .NET application that is https but the rest be http? For instance, just the login page? Does this take extra setup in the application or is it just as simple as an IIS setting?

Answer 1

Yes you can. I recommend this free open source DLL that lets you designate which pages and folders need SSL and which don’t:

http://www.codeproject.com/KB/web-security/WebPageSecurity_v2.aspx

So you can setup a page to be secure in your web.config like this:

<secureWebPages encryptedUri="www.example.com" unencryptedUri="www.example.com" mode="RemoteOnly" >
    <files>
      <add path="/MustBeSecure.aspx" secure="Secure" />
    </files>
</secureWebPages>