Force HTTPS after login in MVC - asp.net-mvc

Question

I need to enforce the ssl connection in one MVC 4 application after the user is logged in.
I used [RequireHttps] attribute on the Login action but the user is still able to navigate with the http protocol if he manually sets the protocol to http.
How to avoid that?
I don't want to force SSL on the whole site everytime but just on the login page and when the user logs in. After he logs out he should be redirected to the homepage with a http protocol

Answer 1

After reading your comments, you're really better off just sending all your traffic over HTTPS instead of picking if they should use HTTPS depending if they are logged in or not.
But if you still want to, try extending RequireHttpsAttribute:
public class RequireUserHttpsAttribute : RequireHttpsAttribute
{
public override void OnAuthorization(AuthorizationContext filterContext)
{
if (filterContext == null)
{
throw new ArgumentNullException("filterContext");
}
if (!filterContext.HttpContext.Request.IsSecureConnection && filterContext.HttpContext.User.Identity.IsAuthenticated)
{
HandleNonHttpsRequest(filterContext);
}
}
}
You'll probably want to add this as a global filter so it can run on every request. And it also does not handle the HTTP redirection if the user is not logged in, but it should be pretty easy to add in a conditional to handle the redirection back to HTTP.
Again, you're going to spend more time implementing this than just pushing all traffic to HTTPS.
I have a feeling you have a login controller that looks like this:
public class LoginController : Controller {
public ActionResult Login() {
// something here
return View();
}
[RequireHttps, HttpPost]
public ActionResult Login(FormCollection form) {
// test login
return RedirectToAction("/");
}
}
Notice that the original Login action does not have the RequireHttps attribute. Try this instead:
[RequireHttps] // put it here to make the entire controller HTTPS
public class LoginController : Controller {
[RequireHttps] // or here
public ActionResult Login() {
// something here
return View();
}
[RequireHttps, HttpPost]
public ActionResult Login(FormCollection form) {
// test login
return RedirectToAction("/");
}
}
But I would highly encourage you to use HTTPS for your entire application if you're able to. In most situations the security benefits significantly outweigh the very small performance hit.