Question

I have a webserver running IIS 6, .NET MVC with a single domainname. The site uses URL rewriting to produce URLs like:

domain.com/controller/action

I would like to force one (1) controller to use SSL (others should work without SSL). How should I implement this?

Answer 1

Decorate the controller that needs SSL with the RequireHttpsAttribute.

[RequireHttps]
public class SecureController : Controller
{
   ...
}

Although, you may prefer a custom version that ignores this for requests from localhost if you are using Cassini for debugging.

[AttributeUsage( AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false )]
public class RemoteRedirectToHttpsAttribute : RequireHttpsAttribute
{
    public override void OnAuthorization( AuthorizationContext filterContext )
    {
        if (filterContext == null)
        {
            throw new ArgumentNullException( "filterContext" );
        }

        if (filterContext.HttpContext != null && (filterContext.HttpContext.Request.IsLocal || filterContext.HttpContext.Request.IsSecureConnection))
        {
            return;
        }

        filterContext.Result = new RedirectResult( filterContext.HttpContext.Request.Url.ToString().Replace( "http:", "https:" ) );
    }
}