Question

I have a requirement where the site needs to allways open in https mode (other than local development). This is internal app.

When i run the site with web.config entry to true for https, it looks like the site goes into circular motion and repeats the request again and again.

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {
        filters.Add(new HandleErrorAttribute());

        //make sure that the remote site opens in https mode.
        bool isSSL = false;
        bool.TryParse(ConfigurationManager.AppSettings[ApplicationKeys.IsSSLRequired], out isSSL);
        if (isSSL && !HttpContext.Current.Request.IsLocal && !HttpContext.Current.Request.IsSecureConnection)
            filters.Add(new RequireHttpsAttribute());

    }
protected void Application_Start()
    {
        AreaRegistration.RegisterAllAreas();

        RegisterGlobalFilters(GlobalFilters.Filters);
        RegisterRoutes(RouteTable.Routes);
        //RouteDebug.RouteDebugger.RewriteRoutesForTesting(RouteTable.Routes);

        //wire up Unity IoC
        container = new UnityContainer();
        UnityBootstrapper.ConfigureContainer(container);
        EntityMapper.MapEntities();
        DependencyResolver.SetResolver(new UnityDependencyResolver(container));
        //wire up Unity Controller Factory
        ControllerBuilder.Current.SetControllerFactory(new UnityControllerFactory());
    }

What am i missing here?

Answer 1

Since you’re already leveraging web.config to drive this functionality, I would suggest that you utilize URL Rewrite.

You can set up a rule to redirect non-HTTPS traffic to HTTPS. See this thread for the configuration:

http://forums.iis.net/t/1149780.aspx

With that in place, you can further improve your development experience by leveraging web.config transformations to enable the rule when you deploy to your production environment.