Question

I have a custom RequireHttps Action Filter. I log in and my site is https, but when you type in a http page while logged in, the action filter never gets hit. I know this because I have logging on and I dont see it being logged anymore. The reason I want it to get it is to test if the user is authenticated and do a 301 redirect to the same page in SSL, but it is never being hit.

Global.asax

 kernel.BindFilter<UseHttpsFilter>(FilterScope.Action, 0)
                          .WhenActionMethodHas<UseHttpsAttribute>()
                          .WithConstructorArgumentFromActionAttribute<UseHttpsAttribute>("requireSecure", q => q.RequireSecure);

                    kernel.BindFilter<UseHttpsFilter>(FilterScope.Controller, 0)
                          .WhenActionMethodHas<UseHttpsAttribute>()
                          .WithConstructorArgumentFromControllerAttribute<UseHttpsAttribute>("requireSecure", q => q.RequireSecure);

UseHttpsAttribute.cs

namespace Site.Web.Attributes
{
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
    public class UseHttpsAttribute : FilterAttribute
    {
        public bool RequireSecure { get; set; }

        public UseHttpsAttribute(bool requireSecure)
        {
            RequireSecure = requireSecure;
        }
    }

    public class UseHttpsFilter : ActionFilterAttribute
    {
        protected static readonly NLogLogger Logger = new NLogLogger();

        public bool RequireSecure = false;

        public UseHttpsFilter(bool requireSecure)
        {
            Logger.Debug("Use Https Constructor: " + requireSecure);
            RequireSecure = requireSecure;
        }

        protected virtual void HandleNonHttpRequest(ActionExecutingContext filterContext)
        {
            if (string.Equals(filterContext.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase))
            {
                string url = "http://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
                filterContext.Result = new RedirectResult(url, true);
            }
        }

        protected void HandleNonHttpsRequest(ActionExecutingContext filterContext)
        {
            if (string.Equals(filterContext.HttpContext.Request.HttpMethod, "GET", StringComparison.OrdinalIgnoreCase))
            {
                string url = "https://" + filterContext.HttpContext.Request.Url.Host + filterContext.HttpContext.Request.RawUrl;
                filterContext.Result = new RedirectResult(url, true);
            }
        }


        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            Logger.Debug("Use Https Authenticated: " + filterContext.RequestContext.HttpContext.User.Identity.IsAuthenticated);

            if (filterContext.RequestContext.HttpContext.User.Identity.IsAuthenticated || HttpContext.Current.Session[Config.ViewData.MemberSession] != null)
            {
                RequireSecure = true;
            }

            Logger.Debug("Use Https Local: " + filterContext.RequestContext.HttpContext.Request.IsLocal);

            if (filterContext.RequestContext.HttpContext.Request.IsLocal)
                RequireSecure = false;

            if (RequireSecure)
            {
                Logger.Debug("Use Https Secure Connection: " + filterContext.HttpContext.Request.IsSecureConnection);

                if (!filterContext.HttpContext.Request.IsSecureConnection)
                {
                    HandleNonHttpsRequest(filterContext);
                }
            }
        }

        public override void OnActionExecuted(ActionExecutedContext filterContext)
        {

        }
    }
}

Answer 1

Found out it was because I had this for the first binding

.WhenActionMethodHas<UseHttpsAttribute>()

intead of

.WhenControllerHas<UseHttpsAttribute>()